Expand resolved record types (TLSA/SVCB/SSHFP/NAPTR) + DANE assessor

[danielmichaels]

Part of #61 · Tier 6 · scanner assessor · Effort: M

Expand the set of resolved record types and add a DANE/TLSA assessor. ResolveDomainWorker currently resolves 13 types; several security-relevant types are missing entirely (no resolution, no table).

Scanner — add record types

• TLSA (DANE) — TLS cert binding.
• HTTPS / SVCB (RFC 9460) — ECH, ALPN, ipv4hint/ipv6hint.
• SSHFP — SSH host-key fingerprints.
• NAPTR — service/ENUM.

For each: add to ResolveDomainWorker (enumerate_jobs.go) + QTypeToString (dns_client.go), a projection table (assets/migrations), an observer Record* method + entity constant (recorder.go), task sqlc.

Assessor — DANE/TLSA

• Validate TLSA records against the served certificate (pairs with the cert scanner): selector/matching-type correctness, record matches presented cert, usage field sanity.
• SVCB/HTTPS hygiene: surface ECH presence/absence, ALPN, hint consistency with A/AAAA.

Cost flag

A few extra record-type queries per scan — bounded, rate-limited via existing client.

Wiring

• scanner + projection tables + observer entities for TLSA/SVCB/HTTPS/SSHFP/NAPTR
• AssessDANEArgs + worker; (a *Assessor) AssessDANE; finding table; UNION/service/UI surfacing
• TDD tests

Decisions for owner

• Which types are must-have now vs later (TLSA + SVCB/HTTPS highest value).