feat(resolver): filter_aaaa for IPv4-only networks (#112)

When enabled, AAAA queries short-circuit to NODATA (NOERROR + empty
answer) so Happy Eyeballs clients don't stall waiting on a v6 address
they can't use. Also strips `ipv6hint` SvcParam from HTTPS/SVCB
answers (RFC 9460) so Chrome ≥103, Firefox, and Safari don't bypass
the AAAA filter via the HTTPS record path.

Local data is preserved: overrides, zones, the .numa proxy, and the
blocklist sinkhole keep whatever v6 addresses they configure — the
filter only kicks in on the cache/forward/recursive path. NODATA is
correct per RFC 2308 here; NXDOMAIN would incorrectly imply the name
doesn't exist for A queries either.

Off by default. Opt in via `filter_aaaa = true` under `[server]`.

src/serve.rs

@@ -236,6 +236,7 @@ pub async fn run(config_path: String) -> crate::Result<()> {
         ca_pem,
         mobile_enabled: config.mobile.enabled,
         mobile_port: config.mobile.port,
+        filter_aaaa: config.server.filter_aaaa,
     });
 
     let zone_count: usize = ctx.zone_map.values().map(|m| m.len()).sum();