fix: reuse DNS inspection connections

[ryanfowler]

Summary

• reuse one UDP socket and one TCP/TLS stream for DNS inspection queries
• reuse one QUIC connection with one stream per DoQ query
• preserve query ordering, partial failures, and timeout budgets

Validation

• cargo fmt --check
• cargo clippy --locked --all-targets --all-features -- -D warnings
• cargo test --locked --all-features --lib --bins
• focused integration suite with --test-threads=2