[codex-inn]

What changed

• DNS Inspector now requests the DNSSEC authenticated-data signal from Cloudflare DNS-over-HTTPS and reports it cautiously as confirmed or unconfirmed.
• DNS snapshots persist the DNSSEC signal and compare it across repeat checks.
• Network Tools now provides a direct entry point to the authenticated local Windows scanner, plus a focused setup guide.
• Added regression tests for DNSSEC query wiring and the local scanner entry point.

Safety

• No fabricated scan data or broader scanning targets were added.
• The local API remains loopback-only and keeps its local-origin restriction; the hosted page opens the local dashboard instead of weakening cross-origin protection.
• LAN scanning still requires explicit authorization and existing private-CIDR / port limits.

Verification

• GitHub Actions tests will run on this pull request.