audit 4: DNS outages unknown, DMARC limits said, typed Health, one TLS mode per upstream

M14, M15: queryEach gives each resolver 2 s within the check's context and
asks the one that answered last first; an address or PTR lookup not
answered is Unknown, an answered mismatch beside it still an error;
Checker.Server keeps the last answer's addresses, so SPF does not go Unknown
with it. Notifications report faults only, now tested with SPF unknown
alone and beside a wrong DKIM.

DMARC reports: tests of malformed XML, gzip and zip bombs, a message over
the limit, the service's Resync, hosted suggestion and validation. The
finding: both limits cut silently and an oversized report failed as
damaged; readAtMost refuses it for its size (MaxMessage 10 MiB, moved into
IngestMessage).

healthReadings replaces map[string]any for Health and Overview.

L5: an inbound upstream has one TLS mode - a second domain to the same
[host]:port with another mode is refused, naming the first; the TLS policy
map holds each next hop once.

Tested on the test server: go vet + go test of 25 packages, make e2e (all
pass, 631 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/dnscheck/dnscheck.go

@@ -145,6 +145,15 @@ func (c *Checker) Server(hostname string, force bool) Server {
 	srv := c.checkServer(ctx, hostname)
 
 	c.mu.Lock()
+	// A lookup the resolvers did not answer finds no addresses; the server
+	// still has the ones the last answer gave, and the SPF check of a domain
+	// asks for them - without them it went Unknown in the same minute
+	// (audit 2026-10-12, M15).
+	if len(srv.IPs) == 0 && srv.PTR.Status == health.StatusUnknown {
+		if prev, ok := c.servers[hostname]; ok {
+			srv.IPs = prev.value.IPs
+		}
+	}
 	c.servers[hostname] = cached[Server]{value: srv, expires: srv.CheckedAt.Add(c.serverTTL)}
 	c.mu.Unlock()
 	return srv