feat(cmd): --json on domains list and domains stats

[mhenrixon]

Summary

• domains list --json emits server.DomainsStatusResponse verbatim (internal/cmd/domains.go) — the RPC struct is the one contract, no CLI-only copy.
• domains stats --json emits a CLI-side DomainsStatsSummary folded from the same response; the text output now prints from the same fold.
• expires_at / fetched_at tags switched from omitempty (no-op on time.Time) to omitzero (internal/server/commands.go) so uncertified hosts stop reporting a year-0001 expiry.
• fetchDomainsStatus callback now returns error so a marshal failure propagates.
• README + ROADMAP entries.

Tables remain the default. The "dynamic domains are not enabled" RPC error stays a non-zero exit in JSON mode — the gem degrades on exit status.

Closes #121

Test plan

• TestDomainsStatusResponse_JSONOmitsZeroTimes — zero times omitted, real ones emitted
• TestDomainsListCommand_JSONFlag / TestDomainsStatsCommand_JSONFlag — flag present, default false
• TestDomainsListCommand_JSONOutputShape — quarantine.<domain>.{until,failures,kind}, held_removals, registered.<host>.service
• TestSummarizeDomains (table-driven) + TestDomainsStatsSummary_JSONKeys
• go test -count=1 ./... ×3 green, gofmt -l empty, go vet clean, make build ok
• Manual: dash-proxy domains list --json against a running proxy; gem follow-up in ../kamal after a tagged image ships

Deviations & judgment calls

• Discovery: make lint panics on the clean main tree too — the locally installed golangci-lint v2.11.3 was built with go1.26 while a dependency now requires go1.27 (file requires newer Go version go1.27). Not caused by this change; CI's lint run is the gate. Not fixed here.
• Judgment call: printJSON is a small shared helper in domains.go rather than duplicating listCommand.displayJSON a third time; list.go is left untouched to keep the diff local.
• Judgment call: DomainsStatsSummary lives in internal/cmd (exported so the type is nameable in docs), not internal/server — it is a presentation fold, not an RPC payload.
• Discovery: the first make test run reported FAIL with no visible failing test in the truncated output; three subsequent go test -count=1 ./... runs were clean. Treated as a pre-existing flake, not investigated further.

---

Summary by cubic

Adds --json to domains list and domains stats so scripts and the dash gem can read domain status without scraping tables. Closes #121.

• domains list --json emits the RPC response verbatim; domains stats --json emits a new DomainsStatsSummary folded from the same response.
• Zero time.Time fields (expires_at, fetched_at) switched to omitzero so uncertified hosts stop reporting a year-0001 expiry.
• fetchDomainsStatus now propagates JSON marshal errors.
• Tables stay the default; the "dynamic domains are not enabled" RPC error still exits non-zero in JSON mode.

^{Written for commit cf91808. Summary will update on new commits.}