WHOIS/RDAP scanner + domain-lifecycle assessor

Part of #61 · Tier 5 · `scanner` `assessor` · Effort: **M**

New passive scanner + domain-lifecycle assessor via RDAP (with WHOIS fallback). Not in the original wishlist; high-value — expiring/unlocked domains are an outage + takeover risk.

### Scanner
- RDAP query (bootstrap to the right registry; WHOIS fallback) → registration/creation/expiry dates, registrar, registrar lock status (`clientTransferProhibited`, `clientDeleteProhibited`, `clientUpdateProhibited`), registry DNSSEC delegation flag, registry-level NS set.
- New projection table for domain-registration facts.

### Assessor
- **Domain-expiry warnings** — tiered (critical near expiry → outage/takeover; high/medium further out).
- Missing registrar transfer/delete lock.
- Registry NS set vs in-zone NS mismatch (delegation drift).

### ⚠️ Cost flag
External RDAP/WHOIS. Rate-limited per registry; cache aggressively (registration data changes slowly — long TTL). Apex domains only (skip subdomains).

### Wiring
- [ ] `internal/scanner/scan_rdap.go` + `ScanRDAPArgs`/`Worker`; register; enqueue in `EnqueueDomainScan` for apex domains
- [ ] projection table + sqlc; `task sqlc`
- [ ] `AssessDomainLifecycleArgs` + worker; `(a *Assessor) AssessDomainLifecycle`
- [ ] finding table (new or reuse), observer entity, UNION/service/UI surfacing
- [ ] TDD tests with a fake RDAP client

### Decisions for owner
- Expiry severity thresholds (e.g. <7d critical, <30d high, <60d medium).
- RDAP-only vs WHOIS fallback.

Unblocks #68 (dangling-NS registrability check reuses this RDAP client).