DNS responder for .fips domain, two-node UDP example

Add DNS responder that resolves <npub>.fips queries to FipsAddress IPv6
addresses. Resolution is pure computation (npub → NodeAddr → IPv6) with
identity cache priming as a side effect, enabling subsequent TUN packet
routing to non-peer destinations.

- New dns.rs module: resolve_fips_query(), handle_dns_packet() using
  simple-dns crate, run_dns_responder() async UDP server loop
- DnsConfig in config.rs: enabled, bind_addr (127.0.0.1), port (5354)
- Fourth select! arm in RX event loop for DNS identity channel
- DNS task spawn/abort in node lifecycle
- 10 new tests (420 total)

Add examples/two-node-udp/ with standalone walkthrough for testing two
FIPS nodes in Linux network namespaces over a veth pair. Includes
network diagram, config files, DNS routing setup, and troubleshooting.

src/lib.rs

@@ -6,6 +6,7 @@
 pub mod bloom;
 pub mod cache;
 pub mod config;
+pub mod dns;
 pub mod icmp;
 pub mod identity;
 pub mod index;
@@ -26,7 +27,10 @@ pub use identity::{
 };
 
 // Re-export config types
-pub use config::{Config, ConfigError, IdentityConfig, TunConfig, UdpConfig};
+pub use config::{Config, ConfigError, DnsConfig, IdentityConfig, TunConfig, UdpConfig};
+
+// Re-export DNS types
+pub use dns::{DnsIdentityRx, DnsIdentityTx, DnsResolvedIdentity};
 
 // Re-export tree types
 pub use tree::{CoordEntry, ParentDeclaration, TreeCoordinate, TreeError, TreeState};