dashboard and status API show why a check failed (closes #225)

/api/v1/status now gives `error` for each nameserver entry and
certificate entry whose status is `error`, copied from the state, which
already kept it. The dashboard shows that reason in place of the records
for a failed nameserver, which used to show the same `-` as one that
answered with no records, and across the CN, issuer and expiry cells
for a failed certificate, wrapped at a width of 20rem so the long TLS
error does not narrow the Endpoint column. The dashboard stylesheet is a
trimmed build, so the new markup uses only classes the page already had.
README Web Dashboard and HTTP API say so.

Model: opus-5-5

TODO.md

@@ -19,6 +19,8 @@ trial run of the finished image: https://git.eeqj.de/sneak/dnswatcher/issues/149
 
 # Completed Steps
 
+- 2026-10-02: the dashboard and `/api/v1/status` show why a nameserver query or
+  a certificate check failed, which only the state file showed (closes #225).
 - 2026-10-02: the startup notification no longer says every notification
   endpoint works; it says it is a test sent to each of them (closes #230).
 - 2026-10-02: a Mattermost webhook that answers an HTTP error is logged as