audit 4: DNS outages unknown, DMARC limits said, typed Health, one TLS mode per upstream

M14, M15: queryEach gives each resolver 2 s within the check's context and
asks the one that answered last first; an address or PTR lookup not
answered is Unknown, an answered mismatch beside it still an error;
Checker.Server keeps the last answer's addresses, so SPF does not go Unknown
with it. Notifications report faults only, now tested with SPF unknown
alone and beside a wrong DKIM.

DMARC reports: tests of malformed XML, gzip and zip bombs, a message over
the limit, the service's Resync, hosted suggestion and validation. The
finding: both limits cut silently and an oversized report failed as
damaged; readAtMost refuses it for its size (MaxMessage 10 MiB, moved into
IngestMessage).

healthReadings replaces map[string]any for Health and Overview.

L5: an inbound upstream has one TLS mode - a second domain to the same
[host]:port with another mode is refused, naming the first; the TLS policy
map holds each next hop once.

Tested on the test server: go vet + go test of 25 packages, make e2e (all
pass, 631 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/dmarc/parse.go

@@ -5,8 +5,8 @@ import (
 	"bytes"
 	"compress/gzip"
 	"encoding/xml"
+	"errors"
 	"fmt"
-	"io"
 	"strconv"
 	"strings"
 	"time"
@@ -207,7 +207,10 @@ func gunzip(raw []byte) ([]byte, error) {
 		return nil, fmt.Errorf("dmarc gzip: %w", err)
 	}
 	defer zr.Close()
-	data, err := io.ReadAll(io.LimitReader(zr, maxAggregateXML))
+	data, err := readAtMost(zr, maxAggregateXML)
+	if errors.Is(err, errTooLarge) {
+		return nil, fmt.Errorf("dmarc gzip: the report is larger than %d MiB uncompressed", maxAggregateXML>>20)
+	}
 	if err != nil {
 		return nil, fmt.Errorf("dmarc gzip read: %w", err)
 	}
@@ -229,8 +232,11 @@ func unzip(raw []byte) ([]byte, error) {
 		if err != nil {
 			return nil, fmt.Errorf("dmarc zip open %q: %w", field(f.Name), err)
 		}
-		data, err := io.ReadAll(io.LimitReader(rc, maxAggregateXML))
+		data, err := readAtMost(rc, maxAggregateXML)
 		rc.Close()
+		if errors.Is(err, errTooLarge) {
+			return nil, fmt.Errorf("dmarc zip: the report is larger than %d MiB uncompressed", maxAggregateXML>>20)
+		}
 		if err != nil {
 			return nil, fmt.Errorf("dmarc zip read %q: %w", field(f.Name), err)
 		}