Resolve PTR names over DNS-over-HTTPS and cache them for the record TTL (closes #238)

`ptr` keeps its field and shape. It now comes from Google, Cloudflare, AdGuard and Quad9 over RFC 8484, tried in turn within 2 seconds, in place of the host's resolver with no cache. Answers stay in memory and in a new `cache.db` for the record's TTL, at most 250,000 addresses. A reserved address is not sent to any resolver and has an empty `ptr`.

Judgement call: each resolver gets an equal share of the time left, so a hung one does not use up the limit.
Judgement call: the negative TTL is the smaller of the SOA minimum and the SOA's own TTL.
Deviation: the cache is SQLite, by sneak's words, not the JSON file the standing rule asks for.

Model: opus-5-5

internal/bogon/bogon_test.go

@@ -8,6 +8,9 @@ import (
 	"git.eeqj.de/sneak/routewatch/internal/bogon"
 )
 
+// privateUseTen is why a prefix or an address inside 10.0.0.0/8 is reserved.
+const privateUseTen = "Private-Use (10.0.0.0/8)"
+
 func TestPrefix(t *testing.T) {
 	t.Parallel()
 
@@ -16,8 +19,8 @@ func TestPrefix(t *testing.T) {
 		// want is why the prefix is reserved, or "" when it is not.
 		want string
 	}{
-		{"10.1.2.0/24", "Private-Use (10.0.0.0/8)"},
-		{"10.0.0.0/8", "Private-Use (10.0.0.0/8)"},
+		{"10.1.2.0/24", privateUseTen},
+		{"10.0.0.0/8", privateUseTen},
 		{"192.0.2.0/24", "Documentation (TEST-NET-1) (192.0.2.0/24)"},
 		{"2001:db8:1::/48", "Documentation (2001:db8::/32)"},
 		{"fd00::/8", "Unique-Local (fc00::/7)"},
@@ -56,6 +59,39 @@ func TestPrefix(t *testing.T) {
 	}
 }
 
+func TestAddr(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		addr string
+		// want is why the address is reserved, or "" when it is not.
+		want string
+	}{
+		{"10.0.0.1", privateUseTen},
+		{"fd00::1", "Unique-Local (fc00::/7)"},
+		// An IPv4 address written in IPv6 form counts as the IPv4 address.
+		{"::ffff:10.0.0.1", privateUseTen},
+		{"::ffff:8.8.8.8", ""},
+		// An address that may be announced, inside a reserved block.
+		{"192.0.0.9", ""},
+		// Addresses anyone may announce.
+		{"8.8.8.8", ""},
+		{"2001:4860:4860::8888", ""},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.addr, func(t *testing.T) {
+			t.Parallel()
+
+			reason, reserved := bogon.Addr(netip.MustParseAddr(tc.addr))
+			if reason != tc.want || reserved != (tc.want != "") {
+				t.Errorf("Addr(%s) = %q, %v; want %q", tc.addr, reason,
+					reserved, tc.want)
+			}
+		})
+	}
+}
+
 func TestASN(t *testing.T) {
 	t.Parallel()