DNSSEC assessor depth + NSEC/NSEC3 scanning

Part of #61 · Tier 6 · `scanner` `assessor` `dnssec` · Effort: **M**

Deepen DNSSEC assessment and wire up the dormant `dnssec_compliance_findings` table. Current `assess_dnssec.go` checks chain-present + deprecated algorithm only.

### Checks to add
- **DS-in-parent matches DNSKEY** — validate the delegation chain to the parent (DS at registry corresponds to a published KSK).
- **RRSIG validity window** — flag RRSIGs near expiry or already expired (broken validation imminent).
- **NSEC vs NSEC3 zone-walking exposure** — NSEC permits trivial zone enumeration; flag NSEC (recommend NSEC3) and weak NSEC3 (low iteration / no opt-out where appropriate).
- Key-length adequacy (KSK/ZSK).
- Algorithm consistency / rollover sanity.
- **Compliance framing** → `dnssec_compliance_findings`.

### Scanner change
- Collect NSEC/NSEC3 records (not currently fetched). The existing inline DNSSEC validation logic in `scan_dnssec.go` is already tagged `// todo: move to assessor` — good moment to refactor.

### Cost flag
Extra DNSKEY/RRSIG/parent-DS queries — bounded, rate-limited.

### Wiring
- [ ] scanner: collect NSEC/NSEC3 + parent DS
- [ ] extend `assess_dnssec.go`; wire `dnssec_compliance_findings` (sqlc, observer, UNION/service/UI)
- [ ] `task sqlc`; extend `assess_dnssec_test.go`

### Decisions for owner
- Severity of NSEC zone-walking (medium?).
- RRSIG-expiry warning window.

Read scan_dnssec.go and assess_dnssec.go to trace the existing DNSSEC collection and assessment flow, then inspect the dormant dnssec_compliance_findings table wiring. Run task sqlc and review assess_dnssec_test.go before extending coverage. Done means NSEC/NSEC3 and parent-DS data are collected, the listed checks are assessed, findings flow through sqlc, observer, UNION/service/UI, and tests pass.

Written by the indexing model from the issue text.