fix(gateway): tolerate partial dual-stack DNS failures - #447

Summary

• enable reqwest's Hickory DNS resolver for upstream gateway requests
• preserve a successful A or AAAA result when the other address family returns SERVFAIL or times out
• return an honest upstream_unavailable response for forwarding failures instead of reporting a policy-rule resolution error
• add regression coverage for the forwarding error response

Why

The default system resolver can fail the entire lookup when only the AAAA leg is broken, even if the host has a valid and reachable A record. Reqwest's Hickory resolver queries both families independently and retains the successful family, while still supporting dual-stack Happy Eyeballs connection behavior.

Verification

• cargo fmt --all -- --check
• cargo check
• cargo test after syncing latest main (476 unit tests + 8 integration tests passed)

Closes #424