fix: retry https on ConnectTimeout, not just ConnectError

Port 80 is often firewalled (drops packets → ConnectTimeout) rather than
refused (ConnectError). Previously ConnectTimeout hit the generic except
branch and broke without trying https, marking everything dead.

Now ConnectError + RemoteProtocolError + ConnectTimeout all trigger an
https retry. ReadTimeout still marks dead (server responded on connect
but was too slow).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/validator.py

@@ -152,14 +152,15 @@ async def _check_domain(domain: str) -> dict:
             result["prescreen_status"] = "live"
             return result
 
-        except (httpx.ConnectError, httpx.RemoteProtocolError) as e:
-            # Port refused or bad HTTP response → server may be https-only, try it
+        except (httpx.ConnectError, httpx.RemoteProtocolError, httpx.ConnectTimeout) as e:
+            # Port refused, wrong protocol, or port 80 firewalled/timed-out
+            # → server may be https-only, always retry on 443
             if scheme == "http":
                 logger.debug("Validator %s: %s on http, trying https", domain, type(e).__name__)
                 continue
             break
         except Exception as e:
-            # Timeout or other error → https won't help, mark dead
+            # ReadTimeout or other error — connected but server too slow; mark dead
             logger.debug("Validator %s (%s): %s", domain, scheme, type(e).__name__)
             break