feat: implement M1 — core DoH forwarding

- Axum HTTP server with /dns-query endpoint (GET + POST per RFC 8484)
- DNS wire-format parsing via hickory-proto
- Upstream DoH client with round-robin selection
- TOML config file with resolver definitions
- SERVFAIL fallback when upstream is unreachable
- /health endpoint
- Unit tests (7) and integration tests (5)
- Zero warnings, clippy clean, fmt clean

DEVELOP.md

@@ -85,7 +85,7 @@ See [docs/plan.md](docs/plan.md) for the full project plan and milestone checkli
 
 | Milestone | Status |
 |-----------|--------|
-| M1 — Core Forwarding | 🔲 Not started |
+| M1 — Core Forwarding | ✅ Done |
 | M2 — Multiple Upstreams & Config | 🔲 Not started |
 | M3 — Caching | 🔲 Not started |
 | M4 — Observability | 🔲 Not started |