feat: DoT client, recursive optimization, bench refactor

- Add DoT forwarding client (tls://IP#hostname upstream config)
- Recursive: cache NS delegations, serve-stale (RFC 8767), parallel
  NS queries on cold, no TCP fallback on individual UDP timeouts,
  400ms NS/TCP timeout (down from 800/1500ms)
- Reduce recursive p99 from 2367ms to 402ms (vs Unbound's 148ms)
- Refactor benchmark suite: generic compare_two engine, delete
  one-off diagnostics (1969 → 750 lines)
- Code cleanup: forward_query delegates to _raw, Option<String>
  for tls_name, saturating_sub for ns_idx

benches/numa-bench.toml

@@ -5,7 +5,8 @@ api_bind_addr = "127.0.0.1"
 data_dir = "/tmp/numa-bench"
 
 [upstream]
-mode = "recursive"
+mode = "forward"
+address = ["https://9.9.9.9/dns-query"]
 timeout_ms = 10000
 
 [cache]
@@ -15,8 +16,13 @@ max_ttl = 3600
 [blocking]
 enabled = false
 
+[proxy]
+port = 8080
+tls_port = 8443
+
 [dot]
-enabled = false
+enabled = true
+port = 8530
 
 [mobile]
 enabled = false