watcher: a name removed from the targets leaves the state (closes #223)

The port checks, which the first check after startup runs after its DNS
checks, now also remove the domain and hostname entries of names no
longer in DNSWATCHER_TARGETS, and the certificate entries of those names
and of addresses a name no longer resolves to. A configured domain's own
records, saved as a hostname entry under its name, are kept, and so are
the certificate entries of a configured name none of whose nameservers
answered, as its port entries already were. Nothing is notified.

Model: opus-5-5

README.md

@@ -228,6 +228,12 @@ clears them.
   false-positive change notifications.
 - State is written atomically (write to temp file, then rename) to prevent
   corruption.
+- A name removed from `DNSWATCHER_TARGETS` is removed from the state at the
+  first check after startup, without a notification: its domain, hostname and
+  certificate entries go, as do the port entries of addresses no configured name
+  has. The dashboard and `/api/v1/status` then no longer list or count it.
+- Each port check also removes the certificate entries for an address their name
+  no longer resolves to, except while none of the name's nameservers answer.
 
 ### Web Dashboard