feat: SRTT-based nameserver selection (#19)

* feat: SRTT-based nameserver selection for recursive resolver

BIND-style Smoothed RTT (EWMA) tracking per NS IP address. The resolver
learns which nameservers respond fastest and prefers them, eliminating
cascading timeouts from slow/unreachable IPv6 servers.

- New src/srtt.rs: SrttCache with record_rtt, record_failure, sort_by_rtt
- EWMA formula: new = (old * 7 + sample) / 8, 5s failure penalty, 5min decay
- TCP penalty (+100ms) lets SRTT naturally deprioritize IPv6-over-TCP
- Enabled flag embedded in SrttCache (no-op when disabled)
- Batch eviction (64 entries) for O(1) amortized writes at capacity
- Configurable via [upstream] srtt = true/false (default: true)
- Benchmark script: scripts/benchmark.sh (full, cold, warm, compare-all)
- Benchmarks show 12x avg improvement, 0% queries >1s (was 58%)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* feat: show DNSSEC and SRTT status in dashboard + API

Add dnssec and srtt boolean fields to /stats API response.
Display on/off indicators in the dashboard footer.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: apply SRTT decay before EWMA so recovered servers rehabilitate

Without decay-before-EWMA, a server penalized at 5000ms stayed near
that value even after recovery — the stale raw penalty was used as the
EWMA base instead of the decayed estimate. Extract decayed_srtt()
helper and call it in record_rtt() before the smoothing step.

Also restores removed "why" comments in send_query / resolve_recursive.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* docs: add install/upgrade instructions, smarter benchmark priming

README: document `numa install`, `numa service`, Homebrew upgrade,
and `make deploy` workflows. Benchmark: replace fixed `sleep 4` with
`wait_for_priming` that polls cache entry count for stability.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

README.md

@@ -30,11 +30,34 @@ dig @127.0.0.1 ads.google.com       # ✗ blocked → 0.0.0.0
 
 Open the dashboard: **http://numa.numa** (or `http://localhost:5380`)
 
-Or build from source:
+### Set as system resolver
+
+```bash
+# Point your system DNS to Numa (saves originals for uninstall)
+sudo numa install
+
+# Run as a persistent service (auto-starts on boot, restarts if killed)
+sudo numa service start
+```
+
+To uninstall: `sudo numa service stop` removes the service, `sudo numa uninstall` restores your original DNS.
+
+### Upgrade
+
+```bash
+# From Homebrew
+brew upgrade numa
+
+# From source
+make deploy    # builds release, copies binary, re-signs, restarts service
+```
+
+### Build from source
+
 ```bash
 git clone https://github.com/razvandimescu/numa.git && cd numa
 cargo build --release
-sudo ./target/release/numa
+sudo cp target/release/numa /usr/local/bin/numa
 ```
 
 ## Why Numa