resolver: error from ResolveIPAddresses when no nameserver answered (closes #190)

ResolveIPAddresses now returns an error, not no addresses, when no
nameserver of the name's zone answered. A nameserver with status
timeout or error is not an answer; one answer, even NXDOMAIN, is
enough for an empty result without an error.

When every server of a zone fails, FindAuthoritativeNameservers moves
on to the parent name, whose servers only refer the query onward. Such
a referral now has status error, so it is no answer either, and a
hostname's saved records show it as error. The only caller, the
nameserver address lookup, already keeps the previous addresses on an
error; its comment no longer says the resolver hides this case.

Model: opus-5-5

README.md

@@ -491,8 +491,9 @@ tracks reachability:
 | `error`     | Query failed (timeout, SERVFAIL, REFUSED, network error)   |
 
 A nameserver that answers NXDOMAIN or with no records has status `ok` and
-empty `records`. A nameserver whose query failed has status `error`, empty
-`records`, and the reason in `error`.
+empty `records`. A nameserver whose query failed, or that only referred it to
+other nameservers, has status `error`, empty `records`, and the reason in
+`error`.
 
 `nameserverAddresses` lists, by nameserver, the sorted addresses its name
 resolves to. A state file without it loads, and the next check fills it in