fix(gateway): reuse app address DNS resolver

[kvinwang]

Summary

• reuse one AppAddressResolver per gateway proxy instead of constructing a DNS resolver per SNI proxy connection
• use Hickory's built-in TTL-aware DNS cache for positive app-address TXT lookups, with the app-address resolver cache sized to 256 entries
• cap negative DNS caching for app-address lookups at 10 seconds so newly-created TXT records are not hidden by long-lived NXDOMAIN/NODATA responses
• keep the TXT lookup and parsing behavior unchanged, including legacy prefix compatibility and wildcard fallback
• add missing SPDX header / shellcheck suppression for the existing gateway test docs and script so CI remains clean

Why

Creating a new TokioAsyncResolver for each proxied connection prevents Hickory's resolver cache from being reused. Keeping the resolver on ProxyInner lets repeated TXT lookups share the resolver cache while preserving DNS TTL semantics for positive records.

App-address records can appear shortly after registration, so negative responses are capped to a short TTL for this resolver. That keeps the useful positive cache while avoiding a long-lived negative cache miss for newly-created apps.

The cache is bounded via Hickory's LRU cache size, so many distinct SNI domains evict older entries instead of growing memory without bound.

Verification

• cargo check --manifest-path gateway/Cargo.toml
• cargo test --manifest-path gateway/Cargo.toml
• cargo clippy --manifest-path gateway/Cargo.toml -- -D warnings -D clippy::expect_used -D clippy::unwrap_used --allow unused_variables
• bash -n gateway/test-run/test_suite.sh
• shellcheck gateway/test-run/test_suite.sh
• reuse lint
• manual proxy DNS cache smoke test: two HTTPS proxy requests for the same SNI returned successfully while the local TXT DNS server observed one TXT query

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.