WHOIS/RDAP scanner + domain-lifecycle assessor

[danielmichaels]

Part of #61 · Tier 5 · scanner assessor · Effort: M

New passive scanner + domain-lifecycle assessor via RDAP (with WHOIS fallback). Not in the original wishlist; high-value — expiring/unlocked domains are an outage + takeover risk.

Scanner

• RDAP query (bootstrap to the right registry; WHOIS fallback) → registration/creation/expiry dates, registrar, registrar lock status (clientTransferProhibited, clientDeleteProhibited, clientUpdateProhibited), registry DNSSEC delegation flag, registry-level NS set.
• New projection table for domain-registration facts.

Assessor

• Domain-expiry warnings — tiered (critical near expiry → outage/takeover; high/medium further out).
• Missing registrar transfer/delete lock.
• Registry NS set vs in-zone NS mismatch (delegation drift).

⚠️ Cost flag

External RDAP/WHOIS. Rate-limited per registry; cache aggressively (registration data changes slowly — long TTL). Apex domains only (skip subdomains).

Wiring

• internal/scanner/scan_rdap.go + ScanRDAPArgs/Worker; register; enqueue in EnqueueDomainScan for apex domains
• projection table + sqlc; task sqlc
• AssessDomainLifecycleArgs + worker; (a *Assessor) AssessDomainLifecycle
• finding table (new or reuse), observer entity, UNION/service/UI surfacing
• TDD tests with a fake RDAP client

Decisions for owner

• Expiry severity thresholds (e.g. <7d critical, <30d high, <60d medium).
• RDAP-only vs WHOIS fallback.

Unblocks #68 (dangling-NS registrability check reuses this RDAP client).