watcher: an IPv6 address is written in brackets before its port (closes #270)

Port and certificate keys were joined as address:port, so an IPv6
address ran into its port: 2a01:4f8:2200:fd11::1:80 is also an address
on its own. Keys are now joined with net.JoinHostPort and split with
net.SplitHostPort, giving [2a01:4f8:2200:fd11::1]:80 in the state file,
/api/v1/status, the dashboard and Port Change notifications; an IPv4
address is unchanged. A certificate key still splits at its last colon,
since a hostname has none. Tests that built IPv6 keys by hand now use
the bracketed form.

Model: opus-5-5

TODO.md

@@ -10,19 +10,17 @@
 
 # Status
 
-pre-1.0. Work lands on `next` by PR. Open work for 1.0 is tracked on the 1.0
-milestone: https://git.eeqj.de/sneak/dnswatcher/milestone/7
+pre-1.0. No git tags. Work lands on `next` by PR. Open work for 1.0 is tracked
+on the 1.0 milestone: https://git.eeqj.de/sneak/dnswatcher/milestone/7
 
 # Next Step
 
-1.0 tracking issue: https://git.eeqj.de/sneak/dnswatcher/issues/66
+trial run of the finished image: https://git.eeqj.de/sneak/dnswatcher/issues/149
 
 # Completed Steps
 
 - 2026-10-13: an IPv6 address is written in brackets before its port, as in
   `[2001:db8::1]:443`, in keys and Port Change notifications (closes #270).
-- 2026-10-13: `TODO.md` names only open issues as next and future steps, and its
-  Status says nothing about git tags (closes #281).
 - 2026-10-13: a port check that finds port 443 closed removes that address's
   certificate entries, so none is left shown as `ok` (closes #265).
 - 2026-10-13: a state file holding `{}`, or leaving out a section, loads with
@@ -205,4 +203,6 @@ milestone: https://git.eeqj.de/sneak/dnswatcher/milestone/7
 
 # Future Steps
 
-- DNSSEC validation, after 1.0: https://git.eeqj.de/sneak/dnswatcher/issues/59
+- 1.0 readiness: run it with a real config and read the logs:
+  https://git.eeqj.de/sneak/dnswatcher/issues/66
+- review toward 1.0: https://git.eeqj.de/sneak/dnswatcher/issues/144

internal/watcher/ipv6_test.go

@@ -16,8 +16,7 @@ import (
 // certificate keys and the Port Change notification write the address
 // in brackets, so its last group cannot be read as the port, and the
 // second port checks keep the certificate entry, whose address they read
-// back from its key. When a last port check finds port 443 closed, the
-// certificate entry is removed. Nothing is looked up.
+// back from its key. Nothing is looked up.
 func TestIPv6AddressInBrackets(t *testing.T) {
 	t.Parallel()
 
@@ -71,13 +70,4 @@ Port now open`
 	if len(got) != 1 || got[0].Title != title || got[0].Message != want {
 		t.Errorf("sent %v, want one %q with message:\n%s", got, title, want)
 	}
-
-	deps.portChecker.closed = true
-
-	w.CheckAllPorts(t.Context())
-
-	gotCerts = slices.Sorted(maps.Keys(deps.state.GetSnapshot().Certificates))
-	if len(gotCerts) != 0 {
-		t.Errorf("certificate entries %v with port 443 closed, want none", gotCerts)
-	}
 }