feat(panel): show each domain's DNS status in the domain list

The list gave no hint which domains still needed records published — the
verdict lived only on the domain page, one click away per domain. Each row
now carries a badge with the worst of that domain's DKIM, SPF and DMARC
checks, in the panel's shared ok/warn/error/unknown vocabulary, linking to
that domain's DNS status card.

The checks run concurrently across the listed domains: each carries its own
timeout, so in series a dead resolver would multiply that wait by the number
of domains and the list would look hung. They share the checker's cache with
the domain page, so a repeat view costs no lookups and opening a domain
after the list is free.

A domain whose DKIM key cannot be read stays "unknown" rather than being
reported as misconfigured — the missing half of the comparison is this
server's, not the domain's.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/web/templates/dashboard.html

@@ -22,12 +22,13 @@
   {{if .Domains}}
   <table>
     <thead>
-      <tr><th>Domain</th><th>Selector</th><th>Apps</th><th></th></tr>
+      <tr><th>Domain</th><th>DNS</th><th>Selector</th><th>Apps</th><th></th></tr>
     </thead>
     <tbody>
       {{range .Domains}}
       <tr>
         <td><a href="/domains/{{.ID}}">{{.Name}}</a></td>
+        <td><a class="st st-{{.DNS}}" href="/domains/{{.ID}}#dns-status">{{.DNS}}</a></td>
         <td class="muted">{{.DKIMSelector}}</td>
         <td>{{.AppCount}}</td>
         <td class="actions"><a class="danger" href="/domains/{{.ID}}/delete">Delete</a></td>
@@ -35,6 +36,9 @@
       {{end}}
     </tbody>
   </table>
+  <p class="muted">The <em>DNS</em> badge is the worst of the domain's DKIM, SPF
+  and DMARC checks. Results are cached for a few minutes; open a domain for the
+  details and a <em>Re-check</em> button.</p>
   {{else}}
   <p class="muted">No domains yet. Add one above to get started.</p>
   {{end}}