net: add experimental P2P DNS relay

[denuoweb]

Summary

• add an operator-opt-in recursive DNS relay on existing Handshake peer connections
• advertise capability dynamically only while the synced bounded backend is ready
• enforce current-name admission, strict DNS envelopes, public authority port 53 egress, per-peer/global/per-authority rate limits, finite concurrency, deadlines, and cancellation
• add shared wire vectors and focused responder/integration tests

The service bit and packet types are private experimental values. No permanent assignments are requested; the implementation is disabled by default.

Verification

• focused DNS relay suite: 47 passing
• ESLint 9 clean
• real four-node regtest Urkel/DNSSEC/DANE acceptance with the companion browser requester

Companion requester commit: https://github.com/Denuo-Web/hns-dane-browser/tree/021bc5edfea6d250aaa3fd1796b0a1875b3f3b7c

Program relationship

See the canonical program architecture and review order.

[denuoweb]

@nodech — requesting implementation review when bandwidth permits, focused on peer framing, admission and resource isolation, resolver egress, and cache separation. This remains a default-off draft.