LaneDNS: more scanner tools (DNSSEC validation, MTA-STS policy, Is it down, IP location for any IP)

Imported from GitHub issue El-SaMa/oma#215 by @El-SaMa.

---

Real gaps after the 2026-10-14 audit (reverse DNS, blocklists, DKIM selector, header analyzer are done):

1. DNSSEC validation: check DS ↔ DNSKEY chain and RRSIG validity, not just list records.
2. MTA-STS / TLS-RPT: fetch https://mta-sts.<domain>/.well-known/mta-sts.txt, validate mode/mx/max_age, check _smtp._tls; add MTA-STS and CAA generators beside SPF/DMARC.
3. Is it down? check a site from Finland + Speed Lab mirrors with a "Monitor it with Lanetti Uptime" CTA.
4. IP location for any IP (ip-location only shows the visitor's own IP).
5. Domain Report as a public MCP tool (oma.domain_report) reusing the same checks. Each new scanner: add to LANETTI_TOOLS_SCANNERS (OMA sanitizer), API_TOOL map in site/assets/js/app.js, public MCP registry, handbook.

Context (2026-10-14): lanedns.lanetti.fi (Lanetti Tools, standalone PHP site on nilek, repo El-SaMa/lanedns site/) was revamped and OMA became its control plane: usage in /admin/tools/usage, settings in /admin/tools/settings, staff MCP oma.admin_lanetti_tools, config pull GET /api/lanetti-tools/config (link token in LaneDNS storage/oma-link.php). Events: site_events site lanedns.lanetti.fi, tool_run sanitized by services/core-api/src/lanetti-tools/usage-events.ts. Read handbook hosting/netspeed section "OMA is the control plane" and .cursor/rules/lanedns-standalone.mdc (deploy recipe: keep public_html group www-data) before touching LaneDNS.