Expand resolved record types (TLSA/SVCB/SSHFP/NAPTR) + DANE assessor

Part of #61 · Tier 6 · `scanner` `assessor` · Effort: **M**

Expand the set of resolved record types and add a DANE/TLSA assessor. `ResolveDomainWorker` currently resolves 13 types; several security-relevant types are missing entirely (no resolution, no table).

### Scanner — add record types
- **TLSA** (DANE) — TLS cert binding.
- **HTTPS / SVCB** (RFC 9460) — ECH, ALPN, ipv4hint/ipv6hint.
- **SSHFP** — SSH host-key fingerprints.
- **NAPTR** — service/ENUM.

For each: add to `ResolveDomainWorker` (`enumerate_jobs.go`) + `QTypeToString` (`dns_client.go`), a projection table (`assets/migrations`), an observer `Record*` method + entity constant (`recorder.go`), `task sqlc`.

### Assessor — DANE/TLSA
- Validate TLSA records against the served certificate (pairs with the cert scanner): selector/matching-type correctness, record matches presented cert, usage field sanity.
- SVCB/HTTPS hygiene: surface ECH presence/absence, ALPN, hint consistency with A/AAAA.

### Cost flag
A few extra record-type queries per scan — bounded, rate-limited via existing client.

### Wiring
- [ ] scanner + projection tables + observer entities for TLSA/SVCB/HTTPS/SSHFP/NAPTR
- [ ] `AssessDANEArgs` + worker; `(a *Assessor) AssessDANE`; finding table; UNION/service/UI surfacing
- [ ] TDD tests

### Decisions for owner
- Which types are must-have now vs later (TLSA + SVCB/HTTPS highest value).