feat: implement M1 — core DoH forwarding

- Axum HTTP server with /dns-query endpoint (GET + POST per RFC 8484)
- DNS wire-format parsing via hickory-proto
- Upstream DoH client with round-robin selection
- TOML config file with resolver definitions
- SERVFAIL fallback when upstream is unreachable
- /health endpoint
- Unit tests (7) and integration tests (5)
- Zero warnings, clippy clean, fmt clean

config/default.toml

@@ -0,0 +1,14 @@
+[server]
+listen = "0.0.0.0:8800"
+
+[upstream]
+resolvers = [
+    { name = "cloudflare", url = "https://cloudflare-dns.com/dns-query" },
+    { name = "google", url = "https://dns.google/dns-query" },
+]
+strategy = "round-robin"
+
+[cache]
+enabled = true
+max_entries = 10000
+max_ttl_secs = 3600