watcher: a name removed from the targets leaves the state (closes #223)

At startup, before the first check, Run removes from the loaded state
the domain, hostname and certificate entries of names no longer in
DNSWATCHER_TARGETS, so the dashboard, /api/v1/status and the startup
notification count only configured names. A configured domain's own
records, saved as a hostname entry under its name, are kept. Nothing is
notified. Each port check, next to the removal of stale port entries,
now also removes the certificate entries for an address a name no
longer resolves to, except while none of its nameservers answered, as
port entries already were.

Model: opus-5-5

TODO.md

@@ -19,6 +19,8 @@ trial run of the finished image: https://git.eeqj.de/sneak/dnswatcher/issues/149
 
 # Completed Steps
 
+- 2026-10-02: a name removed from `DNSWATCHER_TARGETS` leaves the state, and so
+  the dashboard and API, at startup, before the first check (closes #223).
 - 2026-10-02: a Port Change notification lists the port's domains on a
   `Domains:` line and its hostnames on a `Hostnames:` line (closes #248).
 - 2026-10-02: the dashboard's Ports table and `/api/v1/status` port entries list