fix(listener): integrate SERVFAIL, query validation, and UDP truncation (#31 #32 #33)

[olicesx]

Summary

Integrates three related listener-robustness PRs and their review fixes into a single coherent change set:

• fix(dns): truncate oversized UDP responses #31 — UDP response truncation (RFC 6891 / RFC 1035 §4.2.1): respect the client's advertised EDNS payload size (512-byte classic limit without EDNS), truncate at DNS record boundaries, set the TC bit so the client can retry over TCP. Applied consistently to direct, cached, and asynchronous responses.
• fix(proto): validate DNS queries before fast-path handling #32 — Request validation before fast paths: only standard single-question QUERY messages reach the cache/static fast paths. Validates the header, QNAME, compression pointers, every declared Additional record, and EDNS OPT records; rejects trailing data. Prevents response packets and malformed packets from being reflected as answers.
• fix(server): return SERVFAIL instead of dropping valid queries #33 — SERVFAIL instead of silently dropping valid queries: listener processing errors, overall request timeouts, and flow-control permit exhaustion now return SERVFAIL for valid queries. Malformed packets and DNS response packets stay silent (no reflection). Shared wire-format SERVFAIL builder reused by UDP/TCP and DoH.

Review fixes applied on top

• Truncated responses are trimmed to a record boundary: hickory's bounded encoder rolls back its write offset but not the backing buffer, so truncated output could carry partial bytes from the failed record past the corrected header counts. valid_message_len re-walks the emitted sections and trims trailing garbage. Verified red-green: without the trim, a >512B TXT response emitted 13 bytes of trailing data.
• Overload path drops parse_quick-rejected packets silently (cheapest overload rejection; the header gate already rejected non-standard packets upstream).
• TCP framing uses write_all_vectored (zero-allocation, complete-frame guarantee).
• DRY: the strict SERVFAIL builder reuses is_standard_query_header so listener and fast-path validation cannot drift apart.
• CI: binary listener tests (cargo test --bin kixdns) are now executed by the CI test job — they previously never ran.
• Docs: inbound validation / SERVFAIL / truncation behavior documented in README and README.zh-CN.

Verification

• cargo test --lib — 100 passed
• cargo test --bin kixdns — 6 passed (real UDP/TCP/DoH integration, incl. overload + malformed silence)
• cargo test --test doh_integration — 9 passed
• cargo clippy --all-targets --all-features --locked -- -D warnings — clean
• cargo fmt --all -- --check — clean

Closes #31, #32, #33.