healthcheck: answer 503 when the last round of DNS checks reached no root server (closes #302)

The health check answered ok while every DNS lookup failed, as on a
network that intercepts DNS queries. A lookup whose root servers give no
usable reply now fails with ErrNoRootServerAnswered. At the end of each
round of DNS checks the watcher records whether every lookup failed with
it or with ErrIntercepted; the health check then gives status error, and
/.well-known/healthcheck and /health answer 503. Until the first round
finishes it stays ok.

The health check now depends on the watcher, so fx builds the watcher
first: its first round starts before the HTTP server listens, and the
server tests' fx graph includes it. NewWithRootServers lets tests start
a resolver's walks at real servers that are not root servers.

Model: opus-5-5

internal/watcher/dnsunreachable_test.go

@@ -0,0 +1,65 @@
+package watcher_test
+
+import (
+	"log/slog"
+	"testing"
+
+	"sneak.berlin/go/dnswatcher/internal/resolver"
+	"sneak.berlin/go/dnswatcher/internal/watcher"
+)
+
+// TestDNSUnreachableWhenNoRootServerReplies runs one round of checks of
+// a domain and a hostname with every walk starting at real servers that
+// are not root servers. At 192.0.2.1, a documentation address, nothing
+// answers, as when no root server answers. Public recursive resolvers of
+// four operators mark their replies recursion available, as on a network
+// that intercepts DNS queries; one that gives no reply is passed over
+// for the next, and if none replies, no root server answered. Either
+// way no lookup got a reply from a root server, so the round could not
+// reach the DNS. TestFirstRunBaseline and TestDomainThatDoesNotExist
+// check rounds in which the root servers answered.
+func TestDNSUnreachableWhenNoRootServerReplies(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		servers []string
+	}{
+		{"no root server answers", []string{"192.0.2.1"}},
+		{
+			"the network intercepts DNS queries",
+			[]string{"1.1.1.1", "8.8.8.8", "9.9.9.9", "208.67.222.222"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			cfg := defaultTestConfig(t)
+			cfg.Domains = []string{testSmallDomain}
+			cfg.Hostnames = []string{testHost}
+
+			deps := newTestDeps(t, cfg)
+			w := watcher.NewForTest(
+				cfg,
+				deps.state,
+				resolver.NewWithRootServers(slog.Default(), tt.servers),
+				deps.portChecker,
+				deps.tlsChecker,
+				deps.notifier,
+			)
+
+			if w.DNSUnreachable() {
+				t.Error("DNSUnreachable is true before the first round")
+			}
+
+			w.RunOnce(t.Context())
+
+			if !w.DNSUnreachable() {
+				t.Error("DNSUnreachable is false after a round in " +
+					"which no lookup got a reply from a root server")
+			}
+		})
+	}
+}