Add DNS-over-HTTPS (DoH) support (RFC 8484)

[joyider]

Part of Protocol breadth in the Enterprise DNS Roadmap.

Add DNS-over-HTTPS (RFC 8484) for the authoritative query path.

Largest effort of the current observability/protocol items: requires an HTTP/2 layer and DNS wire-format handling over GET ?dns=<base64url> and POST application/dns-message. Should reuse the health (/healthz, /readyz) and metrics plumbing once those exist, so it is sequenced last.

Scope

• application/dns-message request/response handling (POST and GET ?dns=)
• HTTP/2 endpoint, configurable bind/port, TLS config reuse where possible
• Respect EDNS / max UDP size / truncation semantics consistent with UDP/TCP paths
• Honor the existing per-client rate limiting and emit the same metrics/labels
• Config flags to enable/disable; off by default
• Interop test against a known DoH client (e.g. kdig +https, curl)
• OpenAPI / docs

Best done after #15 (Prometheus metrics) and the health endpoints so it has observability hooks from day one.