Resolve PTR names over DNS-over-HTTPS and cache them for the record TTL (closes #238)

`internal/ptr` asks Google, Cloudflare, AdGuard and Quad9 in turn, 2 seconds in all per address. It keeps answers in memory and writes them through to `cache.db`, opened by the new `internal/cachedb`.

Judgement calls:
- Each resolver gets an equal share of the time left, so a hung resolver does not use up the 2 seconds.
- The negative TTL is the smaller of the SOA minimum and the SOA's own TTL (RFC 2308).
- Names that are not host names are dropped, as `net.Resolver.LookupAddr` does.

Model: opus-5-5

.dockerignore

@@ -93,11 +93,12 @@
 **/*.dylib
 
 # Local databases. The image carries a source archive of the whole build
-# context, so these would otherwise ship inside it. The daemon's database
-# is db.sqlite, with its -wal and -shm files while it runs.
+# context, so these would otherwise ship inside it. The daemon's databases
+# are db.sqlite and cache.db, with their -wal and -shm files while it runs.
 **/*.db
 **/*.db-journal
 **/*.db-wal
+**/*.db-shm
 **/*.sqlite
 **/*.sqlite-wal
 **/*.sqlite-shm