watcher: an IPv6 address is written in brackets before its port (closes #270)

Port and certificate keys were joined as address:port, so an IPv6
address ran into its port: 2a01:4f8:2200:fd11::1:80 is also an address
on its own. Keys are now joined with net.JoinHostPort and split with
net.SplitHostPort, giving [2a01:4f8:2200:fd11::1]:80 in the state file,
/api/v1/status, the dashboard and Port Change notifications; an IPv4
address is unchanged. A certificate key still splits at its last colon,
since a hostname has none. Tests that built IPv6 keys by hand now use
the bracketed form, and a test checks that an IPv6 address's
certificate entry is removed when its port 443 closes.

Model: opus-5-5

TODO.md

@@ -10,17 +10,19 @@
 
 # Status
 
-pre-1.0. No git tags. Work lands on `next` by PR. Open work for 1.0 is tracked
-on the 1.0 milestone: https://git.eeqj.de/sneak/dnswatcher/milestone/7
+pre-1.0. Work lands on `next` by PR. Open work for 1.0 is tracked on the 1.0
+milestone: https://git.eeqj.de/sneak/dnswatcher/milestone/7
 
 # Next Step
 
-trial run of the finished image: https://git.eeqj.de/sneak/dnswatcher/issues/149
+1.0 tracking issue: https://git.eeqj.de/sneak/dnswatcher/issues/66
 
 # Completed Steps
 
 - 2026-10-13: an IPv6 address is written in brackets before its port, as in
   `[2001:db8::1]:443`, in keys and Port Change notifications (closes #270).
+- 2026-10-13: `TODO.md` names only open issues as next and future steps, and its
+  Status says nothing about git tags (closes #281).
 - 2026-10-13: a port check that finds port 443 closed removes that address's
   certificate entries, so none is left shown as `ok` (closes #265).
 - 2026-10-13: a state file holding `{}`, or leaving out a section, loads with
@@ -203,6 +205,4 @@ trial run of the finished image: https://git.eeqj.de/sneak/dnswatcher/issues/149
 
 # Future Steps
 
-- 1.0 readiness: run it with a real config and read the logs:
-  https://git.eeqj.de/sneak/dnswatcher/issues/66
-- review toward 1.0: https://git.eeqj.de/sneak/dnswatcher/issues/144
+- DNSSEC validation, after 1.0: https://git.eeqj.de/sneak/dnswatcher/issues/59

internal/watcher/ipv6_test.go

@@ -16,7 +16,8 @@ import (
 // certificate keys and the Port Change notification write the address
 // in brackets, so its last group cannot be read as the port, and the
 // second port checks keep the certificate entry, whose address they read
-// back from its key. Nothing is looked up.
+// back from its key. When a last port check finds port 443 closed, the
+// certificate entry is removed. Nothing is looked up.
 func TestIPv6AddressInBrackets(t *testing.T) {
 	t.Parallel()
 
@@ -70,4 +71,13 @@ Port now open`
 	if len(got) != 1 || got[0].Title != title || got[0].Message != want {
 		t.Errorf("sent %v, want one %q with message:\n%s", got, title, want)
 	}
+
+	deps.portChecker.closed = true
+
+	w.CheckAllPorts(t.Context())
+
+	gotCerts = slices.Sorted(maps.Keys(deps.state.GetSnapshot().Certificates))
+	if len(gotCerts) != 0 {
+		t.Errorf("certificate entries %v with port 443 closed, want none", gotCerts)
+	}
 }