feat: implement watcher monitoring orchestrator

Implements the full monitoring loop:
- Immediate checks on startup, then periodic DNS+port and TLS cycles
- Domain NS change detection with notifications
- Per-nameserver hostname record tracking with change/failure/recovery
  and inconsistency detection
- TCP port 80/443 monitoring with state change notifications
- TLS certificate monitoring with change, expiry, and failure detection
- State persistence after each cycle
- First run establishes baseline without notifications
- Graceful shutdown via context cancellation

Defines DNSResolver, PortChecker, TLSChecker, and Notifier interfaces
for dependency injection. Updates main.go fx wiring and resolver stub
signature to match per-NS record format.

Closes #2

internal/resolver/resolver.go

@@ -46,11 +46,11 @@ func (r *Resolver) LookupNS(
 }
 
 // LookupAllRecords performs iterative resolution to find all DNS
-// records for the given hostname.
+// records for the given hostname, keyed by authoritative nameserver.
 func (r *Resolver) LookupAllRecords(
 	_ context.Context,
 	_ string,
-) (map[string][]string, error) {
+) (map[string]map[string][]string, error) {
 	return nil, ErrNotImplemented
 }