resolver, watcher: a domain's nameservers are only its own delegation (closes #222)

When a domain's parent zone's servers answer NXDOMAIN, LookupNS returns
ErrNXDomain. The watcher then saves the domain with no nameservers and
nxdomain set, shown on the dashboard and in /api/v1/status, asks for none
of its records and removes those saved, so its old nameservers go in one
NS Change. A domain with no delegation of its own gets an empty set and
its records are still asked at the zone it is in.
FindAuthoritativeNameservers moves to a parent name only on one of those
two answers; when the servers do not answer, it returns the error. After
an upgrade, a domain without its own delegation that was saved with its
parent zone's nameservers gets one NS Change; the README says so.

Model: opus-5-5

internal/watcher/interfaces.go

@@ -11,7 +11,9 @@ import (
 
 // DNSResolver performs iterative DNS resolution.
 type DNSResolver interface {
-	// LookupNS discovers authoritative nameservers for a domain.
+	// LookupNS returns a domain's NS record set, as its parent zone's
+	// servers delegate it: empty when they answer that it has none, and
+	// resolver.ErrNXDomain when they answer that it does not exist.
 	LookupNS(
 		ctx context.Context,
 		domain string,