Fix $TTL in the zone parser; add make check-go

The zone parser ignored an explicit $TTL and stamped every record with the SOA
minimum instead, so a 60s zone served 3600s and DefaultTTL was wrong too.
RFC 1035 §5.2: an explicit $TTL wins. qualifyRdata was also added to apply
RFC 1035 §5.1 relative-name expansion to RDATA, which is correct but has one
outstanding defect noted below.

make check-go is the tight inner loop: gofmt check, go vet, compile. It uses
go-build rather than build, because build depends on web and shells out to npm
to rebuild a console bundle that rarely changes. check now depends on it, so
the fast path and the CI path cannot drift apart.

Outstanding, not fixed here: a relative CNAME target is still emitted as
"host." instead of "host.example.com.". qualifyRdata is called with the right
origin, and relative() is correct in isolation, so the target is almost
certainly being dot-terminated in Zone.assemble before dns.NewRR ever sees it,
which makes relative() treat it as already absolute. Narrowed to that, not
confirmed — see the localzone test failures.

Makefile

@@ -63,7 +63,16 @@ web-dev: ## Run the Vite dev server (proxies /api to 127.0.0.1:8080)
 ## Verify
 
 .PHONY: check
-check: fmt-check vet test ## What CI runs
+check: check-go test ## What CI runs (format, vet, compile, then the suite)
+
+.PHONY: check-go
+check-go: fmt-check vet go-build ## The tight inner loop: format, vet, compile. No npm, no tests
+	@echo "check-go: ok"
+
+.PHONY: gofmt-w
+gofmt-w: ## Format every Go file in the tree, including ones just created
+	@gofmt -w $(GOFILES)
+	@echo "gofmt: ok"
 .PHONY: test
 test: ## Run the test suite with the race detector
 	$(GO) test $(TESTFLAGS) ./...