feat: per-suffix conditional forwarding rules in numa.toml (#82)

Adds a `[[forwarding]]` config section so users can explicitly route
domain suffixes to specific upstreams. Config-declared rules take
precedence over auto-discovered rules (macOS scutil, Linux search
domains) via first-match semantics.

Example — the reporter's reverse-DNS case:

  [[forwarding]]
  suffix = "168.192.in-addr.arpa"
  upstream = "100.90.1.63:5361"

Bare IPs default to port 53. IPv6 is supported via
parse_upstream_addr. ForwardingRule::new() constructor replaces
direct struct-literal construction, and make_rule() now delegates
to parse_upstream_addr to fix a latent IPv6 parsing bug.

src/main.rs

@@ -210,7 +210,14 @@ async fn main() -> numa::Result<()> {
     }
     service_store.load_persisted();
 
-    let forwarding_rules = system_dns.forwarding_rules;
+    let forwarding_rules =
+        numa::config::merge_forwarding_rules(&config.forwarding, system_dns.forwarding_rules)?;
+    for rule in forwarding_rules.iter().take(config.forwarding.len()) {
+        info!(
+            "forwarding .{} to {} (config rule)",
+            rule.suffix, rule.upstream
+        );
+    }
 
     // Resolve data_dir from config, falling back to the platform default.
     // Used for TLS CA storage below and stored on ServerCtx for runtime use.