healthcheck: answer 503 when the last round of DNS checks reached no root server (closes #302)

The health check answered ok while every DNS lookup failed, as on a
network that intercepts DNS queries. A lookup whose root servers give no
usable reply now fails with ErrNoRootServerAnswered. At the end of each
round of DNS checks the watcher records whether every lookup failed with
it or with ErrIntercepted; the health check then gives status error, and
/.well-known/healthcheck and /health answer 503. Until the first round
finishes it stays ok.

The health check now depends on the watcher, so fx builds the watcher
first: its first round starts before the HTTP server listens, and the
server tests' fx graph includes it. NewWithRootServers lets tests start
a resolver's walks at real servers that are not root servers.

Model: opus-5-5

internal/resolver/resolver_test.go

@@ -815,6 +815,7 @@ func TestQueryServers_EveryRootServerRefused(t *testing.T) {
 // but nothing answers at 192.0.2.1, a documentation address, so not
 // every server refused, wherever 192.0.2.1 falls in the random order:
 // the error is not ErrIntercepted and does not say every server refused.
+// No root server gave a usable reply, so it is ErrNoRootServerAnswered.
 func TestQueryServers_NotEveryRootServerRefused(t *testing.T) {
 	t.Parallel()
 
@@ -848,6 +849,34 @@ func TestQueryServers_NotEveryRootServerRefused(t *testing.T) {
 	require.NotErrorIs(t, err, resolver.ErrIntercepted)
 	// Both errors for every server refusing say "refused a query for".
 	require.NotContains(t, err.Error(), "refused a query for")
+	require.ErrorIs(t, err, resolver.ErrNoRootServerAnswered)
+}
+
+// TestLookupsWhenNoRootServerAnswers starts every walk at 192.0.2.1, a
+// documentation address where nothing answers, as if no root server
+// answered. The lookups the watcher makes, LookupNS for a domain and
+// LookupAllRecords for a hostname, both fail with
+// ErrNoRootServerAnswered, which the watcher reads.
+func TestLookupsWhenNoRootServerAnswers(t *testing.T) {
+	t.Parallel()
+
+	r := resolver.NewWithRootServers(slog.Default(), []string{noAnswerAddress})
+
+	t.Run("LookupNS", func(t *testing.T) {
+		t.Parallel()
+
+		_, err := r.LookupNS(t.Context(), "google.com")
+		require.ErrorIs(t, err, resolver.ErrNoRootServerAnswered)
+		require.NotErrorIs(t, err, resolver.ErrIntercepted)
+	})
+
+	t.Run("LookupAllRecords", func(t *testing.T) {
+		t.Parallel()
+
+		_, err := r.LookupAllRecords(t.Context(), "www.google.com")
+		require.ErrorIs(t, err, resolver.ErrNoRootServerAnswered)
+		require.NotErrorIs(t, err, resolver.ErrIntercepted)
+	})
 }
 
 // TestQueryServers_RecursiveResolversAsRootServers passes public