Resolve PTR names over DNS-over-HTTPS and cache them for the record TTL (closes #238)

`ptr` keeps its field and shape. It now comes from Google, Cloudflare, AdGuard and Quad9 over RFC 8484, tried in turn within 2 seconds, in place of the host's resolver with no cache. Answers stay in memory and in a new `cache.db` for the record's TTL, at most 250,000 addresses. A reserved address is not sent to any resolver and has an empty `ptr`.

Judgement call: each resolver gets an equal share of the time left, so a hung one does not use up the limit.
Judgement call: the negative TTL is the smaller of the SOA minimum and the SOA's own TTL.
Deviation: the cache is SQLite, by sneak's words, not the JSON file the standing rule asks for.

Model: opus-5-5

.gitignore

@@ -68,10 +68,12 @@ go.work
 go.work.sum
 
 # Local databases, temporary files and debug output. The daemon's
-# database is db.sqlite, with its -wal and -shm files while it runs.
+# databases are db.sqlite and cache.db, with their -wal and -shm files
+# while it runs.
 *.db
 *.db-journal
 *.db-wal
+*.db-shm
 *.sqlite
 *.sqlite-wal
 *.sqlite-shm