feat(panel): show each domain's DNS status in the domain list

The list gave no hint which domains still needed records published — the
verdict lived only on the domain page, one click away per domain. Each row
now carries a badge with the worst of that domain's DKIM, SPF and DMARC
checks, in the panel's shared ok/warn/error/unknown vocabulary, linking to
that domain's DNS status card.

The checks run concurrently across the listed domains: each carries its own
timeout, so in series a dead resolver would multiply that wait by the number
of domains and the list would look hung. They share the checker's cache with
the domain page, so a repeat view costs no lookups and opening a domain
after the list is free.

A domain whose DKIM key cannot be read stays "unknown" rather than being
reported as misconfigured — the missing half of the comparison is this
server's, not the domain's.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/web/static/panel.css

@@ -336,6 +336,11 @@ button.danger:hover, a.danger:hover { background: #912018; }
 .st-warn { background: var(--st-warn-bg); color: var(--st-warn-fg); border-color: var(--st-warn-border); }
 .st-error { background: var(--st-error-bg); color: var(--st-error-fg); border-color: var(--st-error-border); }
 .st-unknown { background: var(--st-unknown-bg); color: var(--st-unknown-fg); border-color: var(--st-unknown-border); }
+/* In the domain list the badge is also the link to that domain's DNS section,
+   so it must not pick up the link colour and underline that would fight with
+   the badge's own palette. */
+a.st, a.st:hover { color: inherit; text-decoration: none; }
+a.st:hover { filter: brightness(1.08); }
 /* Usage bars on the status page's machine card. <meter> rather than a div sized
    from the reading, because the CSP forbids inline styles (see the note at the
    top of this file) and a bar's length has to travel on an attribute. The