Nameserver assessor: true ASN/network diversity (same_network)

Follow-up to #64 (part of #61).

The nameserver assessor's `same_provider` redundancy check currently approximates provider diversity by the **registrable apex** of each nameserver hostname (e.g. `ns1.cloudflare.com` + `ns2.cloudflare.com` → one provider). This catches the common all-NS-at-one-DNS-provider case with **zero egress**, but it misses true network co-location — two nameservers under different vanity hostnames that nonetheless live in the same ASN / data centre.

### Scope
- Resolve each nameserver's A/AAAA (already done in the assessor) and map each IP to its ASN.
- Flag `same_network` when all nameservers share one ASN/prefix despite distinct provider apexes.

### Decision still open (data source)
- **Offline IP→ASN table** (e.g. MaxMind GeoLite ASN): no egress, but a tens-of-MB data dependency needing periodic refresh.
- **External IP→ASN lookup** (e.g. Team Cymru DNS service): no bundled data, but per-scan egress + a third-party runtime dependency.

The `nameserver_redundancy_findings` table already has a `same_network` issue_type slot reserved in its schema comment.

Start with the nameserver assessor's existing A/AAAA resolution path and the nameserver_redundancy_findings schema comment, which reserves the same_network issue type. Investigate the offline-table and external-lookup options, then define how ASN or prefix matches should be recorded and tested; done means true same-network co-location is reported without breaking same_provider checks.

Written by the indexing model from the issue text.