feat: implement M1 — core DoH forwarding

- Axum HTTP server with /dns-query endpoint (GET + POST per RFC 8484)
- DNS wire-format parsing via hickory-proto
- Upstream DoH client with round-robin selection
- TOML config file with resolver definitions
- SERVFAIL fallback when upstream is unreachable
- /health endpoint
- Unit tests (7) and integration tests (5)
- Zero warnings, clippy clean, fmt clean

docs/plan.md

@@ -37,12 +37,12 @@ A lightweight DNS-over-HTTPS (DoH) forwarder that accepts DNS queries over HTTPS
 
 ### M1 — Core Forwarding
 
-- [ ] Project scaffold (Cargo workspace, CI)
-- [ ] HTTP server with `/dns-query` endpoint (GET + POST)
-- [ ] Parse incoming DNS wire-format queries
-- [ ] Forward to a single upstream DoH resolver
-- [ ] Return DNS wire-format response
-- [ ] Basic integration test
+- [x] Project scaffold (Cargo workspace, CI)
+- [x] HTTP server with `/dns-query` endpoint (GET + POST)
+- [x] Parse incoming DNS wire-format queries
+- [x] Forward to a single upstream DoH resolver
+- [x] Return DNS wire-format response
+- [x] Basic integration test
 
 ### M2 — Multiple Upstreams & Config