Round-robin now retries with the next resolver when one fails,
instead of returning the error immediately. Also reduced connect
timeout to 3s and total timeout to 5s for faster failover.
- Add DnsListener that binds UDP and TCP on configurable port
- Add [dns] config section with listen address (default 0.0.0.0:5353)
- DNS over TCP uses 2-byte length prefix (RFC 1035 §4.2.2)
- Forward queries through existing DoH pipeline
- Start DNS listener as background task alongside DoH server
- Failover strategy: try resolvers in order until one succeeds
- Env var overrides: DOH_LISTEN, DOH_UPSTREAM_STRATEGY, DOH_UPSTREAM_RESOLVERS
- Graceful shutdown on SIGINT/SIGTERM
- Strategy parsed from config string to enum
- 14 tests passing, clippy clean, fmt clean
- Axum HTTP server with /dns-query endpoint (GET + POST per RFC 8484)
- DNS wire-format parsing via hickory-proto
- Upstream DoH client with round-robin selection
- TOML config file with resolver definitions
- SERVFAIL fallback when upstream is unreachable
- /health endpoint
- Unit tests (7) and integration tests (5)
- Zero warnings, clippy clean, fmt clean
