Add a DNS protocol analyzer tab (RFC 1035) - #1221

Detect DNS traffic (UDP/TCP port 53) in the capture loop and parse the
message from the transport payload, extracted from `headers.payload`
before `analyze_headers` consumes the headers (the slice borrows
`packet.data`, so it outlives the move). DNS over TCP's 2-byte length
prefix is stripped before parsing.

Parsed messages are pushed to a new `InfoTraffic::dns_events` vector,
carried to the GUI on each tick and reset by `take_but_leave_something`;
`refresh` intentionally ignores it (events are drained GUI-side).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Add a dedicated "DNS" tab to the running pages:

- `gui::types::dns_state`: DnsState holds a bounded live log (VecDeque,
  cap 2000) of DnsEntry rows folded from the backend's DnsEvents.
- `gui::pages::dns_page`: renders a header + scrollable table
  (Time, Q/R, Domain, Type, RCODE, Answers), newest first, with an
  empty-state placeholder; mirrors the inspect_page layout/styles.
- Wire DnsState into Sniffer (field, construction, capture reset) and
  drain `msg.dns_events` into it in `refresh_data`.
- Register RunningPage::Dns (tab label, next/previous, Globe icon) and
  dispatch it in `view`; enable the previously-disabled Globe icon.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Correlate each response with its originating query by transaction id and
(client, server) endpoint pair to compute resolution latency, shown in a
new "Latency" column on response rows. Count queries per domain and
surface the top 5 in a "Top domains" ranking line on the DNS page.

In-flight queries are bounded (cap 10k) to limit memory when queries go
unanswered. Adds unit tests for latency correlation, orphan responses,
and per-domain ranking.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Add two dropdown filters to the DNS page: record type (A, AAAA, CNAME,
MX, TXT, NS, PTR, SOA) and response code (NOERROR, NXDOMAIN, SERVFAIL,
REFUSED, FORMERR, NOTIMP). The summary line shows the filtered count and
an empty-state message distinguishes "no traffic yet" from "no matches".

DnsFilter lives in gui state, is wired through new Message variants, and
applied when rendering the log. Adds a unit test for the matching logic.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

A 2-packet Ethernet/IPv4/UDP capture (query + compressed A response for
google.com) to reproduce and validate the DNS analyzer offline, with a
README describing the expected output and the Wireshark cross-check.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Document how to build, run and try the DNS tab, including offline
reproduction via the sample pcap, satisfying the "installation /
execution / usage example" requirement.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Read docs/samples/dns_sample.pcap and run every packet through the exact
production path (get_sniffable_headers -> payload extraction ->
analyze_headers -> parse_dns), asserting the recovered query/response for
google.com (type A, answer 8.8.8.8). Validates the full capture-to-parse
chain, not just the parser in isolation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The ranking was laid out on a single horizontal row, which overflowed
the page width. Render it as a title followed by one domain per line.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The record-type filter compared only the query type (QTYPE), so filtering
by e.g. CNAME hid responses to A queries whose answer chain contains a
CNAME (common for CDN/Vercel-hosted domains). Track the answer section's
record types per entry and match the filter against the query type OR any
answer record type. Adds a unit test covering a CNAME-in-answer response.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The Answer(s) column showed only RDATA values, so a response to an A query
whose answer chain contains a CNAME looked inconsistent when filtered by
CNAME (the Type column shows the QTYPE, A). Prefix each answer with its
record type, e.g. "CNAME cdn.example.net, A 1.2.3.4", matching dig/tcpdump
and making the answer types visible.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Complete the 12-byte DNS header parsing: read NSCOUNT (Authority) and
ARCOUNT (Additional) record counts. The sections themselves are not
expanded, but their counts are surfaced in the Answer(s) cell as a note
(e.g. "[+1 add'l]"), which also reveals EDNS OPT records. Adds parser
tests for the counts and the note.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>