net: add experimental P2P ODoH relay (stacked on #958)

[denuoweb]

Summary

• add a private experimental Handshake P2P transport for RFC 9230 ODoH messages
• split requester, proxy, and authenticated target roles while reusing the bounded base DNS relay admission and recursive backend
• verify target-identity-signed configuration records, strict locators, replay limits, independent hop IDs, and requester-side DNS correlation
• rotate HPKE keys every 22 hours with a two-hour overlap and wipe retired private keys
• publish deterministic JavaScript/Rust interoperability vectors for the direct-locator profile

Dependency

This is a stacked draft based on the prerequisite P2P DNS relay branch from #958. Review the base relay commit first; this PR currently includes that prerequisite in its diff against master.

The companion native browser requester commit:
https://github.com/Denuo-Web/hns-dane-browser/tree/477c4e8092a062a69f56bf348b382b6f4face898

Verification

• ESLint 9 passes on all touched hsd protocol and test files
• 102 focused hsd tests pass across ODoH, the prerequisite DNS relay, and network framing
• the three-FullNode Brontide regtest trial passes, including old-record acceptance after key rotation and zero proxy plaintext bytes
• the separate four-hsd browser topology passes a mined registered name, current Urkel proofs, distinct ODoH proxy/target hops, live recursion, local DNSSEC and TLSA/DANE, HTTPS 200, blocked browser port 53, and zero legacy DoH contacts

Private service/packet values remain regtest-only and are not standards assignments. No permanent assignments are requested.

Incremental review

The Git history is based directly on the exact #958 implementation commit. GitHub cannot use a branch in a contributor fork as the base of an upstream PR, so the upstream diff also displays the prerequisite. The fork-side stacked draft targets feat/p2p-dns-relay and shows only the incremental ODoH changes.

Program relationship

See the canonical program architecture and review order.

[denuoweb]

@nodech — requesting follow-on review after #958. The fork-side stacked draft at denuoweb#1 shows only the incremental ODoH diff; the upstream PR remains draft.