fix(decoredirect): log reason when isDNSReady returns false

[igoramf]

Summary

• isDNSReady falhava silenciosamente, sem logar o motivo, tornando impossível diagnosticar se o problema era no HTTP check, no header X-Redirect-By, ou no DNS lookup de AAAA
• Descoberto ao investigar o meiasola.com.br preso em CertificateReady=False — o operator logava "DNS not ready yet" mas sem indicar o porquê, exigindo um restart para resolver
• Agora cada caminho de falha loga o erro ou o valor inesperado recebido

Test plan

• Deploy em eks-hub e confirmar que logs de isDNSReady mostram o motivo quando um domínio falha a checagem

🤖 Generated with Claude Code

---

Summary by cubic

Add detailed logging to isDNSReady so we can see why DNS readiness fails instead of failing silently. This helps diagnose stuck certificates by showing whether the HTTP check, X-Redirect-By header, DNS lookup, or blocked IPv6 is the cause.

• Bug Fixes
  • Log HTTP request build errors and HTTP check failures.
  • Log unexpected X-Redirect-By values.
  • Log DNS lookup errors.
  • Log when AAAA records fall within blocked IPv6 CIDRs (include IP and CIDR).

^{Written for commit 316040f. Summary will update on new commits.}