milestone 28: query provenance — every logged query is exactly explainable

query rows gain qclass, rcode, group, policy action and reason, the
matched rule or list entry with its source, cname and safe-search
targets, route kind, forward zone, and the resolver that actually
answered — the pool and local markers die. servfails are logged and
name the resolver that lost; post-parse protocol refusals become rows.
a detail page at /queries/:id renders the ordered explanation, and
coverage watermarks distinguish an empty history from a missing one.

the schema fingerprint changes: existing query history is recreated
with the old file kept aside and the reset filed as a resolved
diagnostic. fixes an oversized udp reply being rebuilt as noerror,
which handed clients a truncated nxdomain as success.

src/upstream/dot_client_live_test.zig

@@ -57,7 +57,9 @@ fn runExchange(io: std.Io, params: Params) anyerror!usize {
         params.bundle_lock,
         params.buffers,
     );
-    const reply = try client.client().exchange(io, query_bytes, params.response_buf);
+    var selected: ?[]const u8 = null;
+    const reply = try client.client().exchange(io, query_bytes, params.response_buf, &selected);
+    std.debug.assert(std.mem.eql(u8, selected.?, endpoint.url));
     return reply.len;
 }