Show the Name servers check as it happens, and keep its results

The zone's Name servers tab no longer waits for the other servers before
showing: it lists each query as a dig command line with a waiting
counter, fills in the answers as they arrive, then shows the result with
the queries under "Queries sent". Results (serials and delegation) are
kept for 10 minutes so revisiting the tab is instant; "Check again" asks
anew, and a check keeps running when the tab is left.

GET /zones/{zone}/serials?stream=1 streams the queries as
newline-delimited JSON (nscheck.Checker.Watch); without it the endpoint
is unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/api.md

@@ -220,6 +220,16 @@ when called ([operations.md](operations.md#checking-name-servers-and-the-delegat
 `error` (with `error`). `source` is `NS record`, `also-notify` or
 `primaries`; `port` is set for a non-default port.
 
+`/serials?stream=1` answers with newline-delimited JSON
+(`application/x-ndjson`) while it works, which is how the web UI shows the
+check's progress. Each query is an event when it is sent and another when
+it is answered: `{"kind": "start", "id": 2, "query": "dig @192.0.2.1
+example.org. SOA +norec"}`, then `{"kind": "end", "id": 2, "result":
+{...}}`. The result is a `servers` entry, or `addresses` or `error` for a
+name server's address lookup. ID 0 is `rndc zonestatus`, which asks this
+server's named. The last line is `{"kind": "done", "response": {...}}`,
+the response above.
+
 `/delegation` returns `parent`, `resolver`, `delegated`, `parent_ns`,
 `jarl_ns`, `parent_servers` (each parent server's `status`: `delegated`,
 `not_delegated`, `unreachable`, `error`, with `ns` and `glue`), `glue`