watcher: warn of an expiring certificate on every TLS check (closes #204)

An expiry warning was skipped when the last one for that hostname and
address was sent less than DNSWATCHER_TLS_INTERVAL ago. Each TLS check
runs after a DNS pass of varying length, so two checks can be less than
the interval apart, and a certificate about to expire was warned about on
every check or every other check, at random. TLS checks already start
once per interval, so the in-memory record of when each warning was sent
is removed and every check warns, as the README says.

The test that expected the second check to stay silent is replaced by one
that runs TLS checks on state built in the test, with no DNS.

Model: opus-5-5

internal/watcher/watcher.go

@@ -7,7 +7,6 @@ import (
 	"slices"
 	"sort"
 	"strings"
-	"sync"
 	"time"
 
 	"go.uber.org/fx"
@@ -49,18 +48,16 @@ type Params struct {
 
 // Watcher orchestrates all monitoring checks on a schedule.
 type Watcher struct {
-	log              *slog.Logger
-	config           *config.Config
-	state            *state.State
-	resolver         DNSResolver
-	portCheck        PortChecker
-	tlsCheck         TLSChecker
-	notify           Notifier
-	cancel           context.CancelFunc
-	done             chan struct{} // closed when Run returns
-	firstRun         bool
-	expiryNotifiedMu sync.Mutex
-	expiryNotified   map[string]time.Time
+	log       *slog.Logger
+	config    *config.Config
+	state     *state.State
+	resolver  DNSResolver
+	portCheck PortChecker
+	tlsCheck  TLSChecker
+	notify    Notifier
+	cancel    context.CancelFunc
+	done      chan struct{} // closed when Run returns
+	firstRun  bool
 }
 
 // New creates a new Watcher instance wired into the fx lifecycle.
@@ -69,15 +66,14 @@ func New(
 	params Params,
 ) (*Watcher, error) {
 	w := &Watcher{
-		log:            params.Logger.Get(),
-		config:         params.Config,
-		state:          params.State,
-		resolver:       params.Resolver,
-		portCheck:      params.PortCheck,
-		tlsCheck:       params.TLSCheck,
-		notify:         params.Notify,
-		firstRun:       true,
-		expiryNotified: make(map[string]time.Time),
+		log:       params.Logger.Get(),
+		config:    params.Config,
+		state:     params.State,
+		resolver:  params.Resolver,
+		portCheck: params.PortCheck,
+		tlsCheck:  params.TLSCheck,
+		notify:    params.Notify,
+		firstRun:  true,
 	}
 
 	lifecycle.Append(fx.Hook{
@@ -1028,22 +1024,6 @@ func (w *Watcher) checkTLSExpiry(
 		return
 	}
 
-	// Deduplicate expiry warnings: don't re-notify for the same
-	// hostname within the TLS check interval.
-	dedupKey := fmt.Sprintf("expiry:%s:%s", hostname, ip)
-
-	w.expiryNotifiedMu.Lock()
-
-	lastNotified, seen := w.expiryNotified[dedupKey]
-	if seen && time.Since(lastNotified) < w.config.TLSInterval {
-		w.expiryNotifiedMu.Unlock()
-
-		return
-	}
-
-	w.expiryNotified[dedupKey] = time.Now()
-	w.expiryNotifiedMu.Unlock()
-
 	msg := fmt.Sprintf(
 		"Host: %s\nIP: %s\nCN: %s\n"+
 			"Expires: %s (%.0f days)",