feat: implement M1 — core DoH forwarding

- Axum HTTP server with /dns-query endpoint (GET + POST per RFC 8484)
- DNS wire-format parsing via hickory-proto
- Upstream DoH client with round-robin selection
- TOML config file with resolver definitions
- SERVFAIL fallback when upstream is unreachable
- /health endpoint
- Unit tests (7) and integration tests (5)
- Zero warnings, clippy clean, fmt clean

Cargo.toml

@@ -0,0 +1,24 @@
+[package]
+name = "doh-forwarder"
+version = "0.1.0"
+edition = "2021"
+description = "A lightweight DNS-over-HTTPS forwarder"
+license = "MIT"
+
+[dependencies]
+axum = "0.8"
+tokio = { version = "1", features = ["full"] }
+hickory-proto = "0.25"
+reqwest = { version = "0.12", features = ["rustls-tls"], default-features = false }
+serde = { version = "1", features = ["derive"] }
+toml = "0.8"
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", features = ["env-filter"] }
+anyhow = "1"
+thiserror = "2"
+bytes = "1"
+base64 = "0.22"
+
+[dev-dependencies]
+tokio-test = "0.4"
+tower = { version = "0.5", features = ["util"] }