feat: sync provider-scoped DoH

[simulacraliasing]

Summary

• extract DoH resolvers and proxy hostnames from each Mihomo provider cache
• resolve each provider's hostnames only through its matching domain policy or proxy resolver list
• persist last-known-good hosts and policies, then validate and hot reload updates atomically
• refresh after startup and every 10 minutes, with a manual task 108 entry
• migrate the earlier managed-block format and preserve unrelated user DNS and hosts entries

Tests

• sh syntax checks for all changed scripts
• tests/provider_dns_test.sh
• BusyBox parsing and DNS query probes against two live provider formats
• isolated config injection validated by the running Mihomo binary