fix(dns): prevent authenticated SVCB downgrade

[ryanfowler]

Summary

• classify verified DoH, DoT, and DoQ resolvers as authenticated
• make authenticated HTTPS/SVCB transport, server, timeout, and malformed-response failures fatal for ECH auto and automatic HTTP/3
• preserve fallback for unauthenticated DNS and authenticated NODATA/NXDOMAIN outcomes
• document the downgrade policy and add authenticated DoH regression tests

Validation

• cargo fmt --check
• cargo clippy --locked --all-targets --all-features -- -D warnings
• cargo test --locked --all-features --lib --bins
• full integration suite from AGENTS.md with --test-threads=2