A/AAAA & wildcard takeover + private-IP hygiene assessor

Part of #61 · Tier 4 · `takeover` · Effort: **M**

Extend the takeover/hygiene surface beyond CNAME to A/AAAA targets and wildcard behaviour.

### Checks
- **A/AAAA cloud-IP takeover:** A/AAAA pointing to deprovisioned/claimable cloud IP ranges (extend the `cname_fingerprints.go` provider catalogue to IP-range matching for the major clouds).
- **Wildcard DNS detection:** explicitly called out in `ARCHITECTURE.md` (CNAME section, Assess Phase). Query a random non-existent label under the domain; if it resolves, the zone uses a wildcard — record it (affects takeover/false-positive logic and is a finding in its own right).
- **Private/reserved IP in public DNS:** A/AAAA → RFC1918 / loopback / link-local / ULA published in public DNS = info leak + DNS-rebinding surface.

### Cost flag
Active: one extra resolution (random label) for wildcard detection; cheap. Rate-limit as usual.

### Storage
Reuse `dangling_cname_findings` family or extend with new issue_types; decide in review.

### Wiring (per #61 recipe)
- [ ] `AssessIPTargetsArgs` + worker; register; enqueue from `ResolveDomainWorker`
- [ ] `(a *Assessor) AssessIPTargets`
- [ ] sqlc + `task sqlc`; observer entity; UNION/service/UI surfacing
- [ ] TDD tests

### Decisions for owner
- Severity for private-IP-in-public-DNS (info vs low).
- Source/maintenance of cloud IP-range data.

Start with the #61 recipe, ARCHITECTURE.md's CNAME/Assess Phase section, and the existing cname_fingerprints.go catalogue. Trace ResolveDomainWorker and the AssessIPTargetsArgs/AssessIPTargets wiring, then review sqlc, observer, service/UI, and TDD test requirements. Done means A/AAAA, wildcard, and private/reserved-IP findings are assessed, stored, surfaced, and tested, with the listed ownership decisions resolved.

Written by the indexing model from the issue text.