Takeover provider list is compiled in; allow extending it from a file #219

Summary

The takeover-prone provider list is compiled into the binary, so every new fingerprint needs a code change and a release (#134, #214). Users who track their own providers, or who want to drop a provider that is noisy for them, can't. A -takeover-providers <file> flag would let them extend or replace the list without waiting for a release.

Where

• internal/dns/takeover.go:15-49 (takeoverProviders): hard-coded {suffix, name} table
• internal/dns/takeover.go:53-61 (TakeoverProvider): suffix matching against that table only

Proposal

• File format: one suffix name pair per line, # comments allowed (same style as -exclude-file), e.g. .example-cdn.net example-cdn.
• Default: merge the file with the built-in list. -takeover-providers-only (or a replace directive in the file) uses only the file.
• Validate suffixes like domains (leading dot, lowercase, IDN through the existing punycode path); reject bad lines with the line number, exit 2.
• Pass the table through the scan config instead of the package global, so pkg/subenum callers can set it too.
• Show the source in -print-config.

Who benefits

Security teams with in-house or regional hosting providers, and maintainers, who get fewer "please add provider X" requests.

Trade-offs

• Keep matching DNS-only; a file can't add HTTP fingerprint checks, and the docs should say a match is still only a hint.

Acceptance criteria

• Flag, config key and SUBENUM_* env var via the settings table (One table for setting tokens, flag names, config fields and TUI labels #160)
• Merge and replace modes tested; bad lines report line numbers
• TakeoverProvider no longer reads a mutable global
• Docs (docs/cli.md, README flag table via make docs-flags) and CHANGELOG

Getting started

• Relevant files: internal/dns/takeover.go, internal/scan/settings.go, main.go
• Tests: go test ./internal/dns/ ./...
• Related: Add more takeover-prone providers to the CNAME fingerprint list #134, fix(dns): recognize Anima and Discourse takeover targets #214

_{Filed by repo-audit/feature-ideas at 3fd0128. Severity: medium. Effort: M. audit-key: enhancement|internal/dns/takeover.go|takeoverProviders}