watcher: a name removed from the targets leaves the state (closes #223)

At startup, before the first check, Run removes from the loaded state
the domain, hostname and certificate entries of names no longer in
DNSWATCHER_TARGETS, so the dashboard, /api/v1/status and the startup
notification count only configured names. A configured domain's own
records, saved as a hostname entry under its name, are kept. Nothing is
notified. Each port check, next to the removal of stale port entries,
now also removes the certificate entries for an address a name no
longer resolves to, except while none of its nameservers answered, as
port entries already were.

Model: opus-5-5

internal/watcher/watcher.go

@@ -164,31 +164,6 @@ func (w *Watcher) Run(ctx context.Context) {
 	}
 }
 
-// cleanupRemovedTargets removes from the loaded state the domain,
-// hostname and certificate entries of names no longer in the
-// configuration, which changes only at a restart. Nothing is notified.
-// A configured domain's own records are saved as a hostname entry under
-// its name, which is kept.
-func (w *Watcher) cleanupRemovedTargets() {
-	for _, name := range w.state.GetAllDomainNames() {
-		if !w.isDomain(name) {
-			w.state.DeleteDomainState(name)
-		}
-	}
-
-	for _, name := range w.state.GetAllHostnames() {
-		if !w.isConfigured(name) {
-			w.state.DeleteHostnameState(name)
-		}
-	}
-
-	for _, key := range w.state.GetAllCertificateKeys() {
-		if _, hostname := parseCertKey(key); !w.isConfigured(hostname) {
-			w.state.DeleteCertificateState(key)
-		}
-	}
-}
-
 // RunOnce performs a single complete monitoring cycle.
 // DNS checks run first so that port and TLS checks use
 // freshly resolved IP addresses. Port checks run before
@@ -226,6 +201,31 @@ func (w *Watcher) detectFirstRun() {
 	}
 }
 
+// cleanupRemovedTargets removes from the loaded state the domain,
+// hostname and certificate entries of names no longer in the
+// configuration, which changes only at a restart. Nothing is notified.
+// A configured domain's own records are saved as a hostname entry under
+// its name, which is kept.
+func (w *Watcher) cleanupRemovedTargets() {
+	for _, name := range w.state.GetAllDomainNames() {
+		if !w.isDomain(name) {
+			w.state.DeleteDomainState(name)
+		}
+	}
+
+	for _, name := range w.state.GetAllHostnames() {
+		if !w.isConfigured(name) {
+			w.state.DeleteHostnameState(name)
+		}
+	}
+
+	for _, key := range w.state.GetAllCertificateKeys() {
+		if _, hostname := parseCertKey(key); !w.isConfigured(hostname) {
+			w.state.DeleteCertificateState(key)
+		}
+	}
+}
+
 // runDNSChecks performs DNS resolution for all configured domains
 // and hostnames, updating state with freshly resolved records.
 // This must complete before port or TLS checks run so those