milestone 25: client names learned over reverse dns

PLAN.md

@@ -309,6 +309,7 @@ entry `x.y` and a wildcard entry `x.y`, which together give domain-and-subdomain
 
 - Per source IP: (1) exact match in `clients`, (2) longest-prefix match in `client_prefixes` (ties: longer prefix, then priority), (3) `default` group.
 - Auto-materialization: first query from an unseen IP inserts a `clients` row (`hand_edited=0`, `first_seen=now`) for UI visibility and stable group assignment. The query log does **not** FK to it (§3.6).
+- Materialized clients name themselves: the tracker's flush pass sends one PTR query per unnamed row through the declared forward zones (§6.5), and the answer is runtime state in `learned_name`, never configuration.
 - Retention drops `hand_edited=0` clients with no queries in `retention_days`.
 
 ### 7.3 Reload
@@ -387,6 +388,8 @@ CREATE TABLE clients (
     id INTEGER PRIMARY KEY,
     ip TEXT NOT NULL UNIQUE,            -- canonical text form (v4 dotted / v6 RFC 5952)
     name TEXT,
+    learned_name TEXT,
+    name_attempt_after INTEGER NOT NULL DEFAULT 0,
     group_id INTEGER NOT NULL REFERENCES groups(id),
     hand_edited INTEGER NOT NULL DEFAULT 0,
     first_seen INTEGER NOT NULL,