Correct trusted DoH resolver contracts

[moelayyan90]

Production deployment 0155727 reached the exact tagged Worker and failed only at POST /v1/pricing/quote with HTTP 422 dns_unresolved.

Root cause: the fallback used Cloudflare's application/dns-json MIME type for Google's JSON endpoint and rejected trusted redirects; both resolvers returned immediately without a usable response.

This fix:

• uses resolver-specific MIME contracts;
• adds Cloudflare's documented one.one.one.one JSON endpoint;
• follows redirects only when the final host remains in the resolver's trust set;
• queries trusted resolvers concurrently;
• still requires successful A and AAAA resolution and rejects any private answer;
• records the quote probe's HTTP status and stable error code without leaking signed payloads.

Focused behavior tests: 19/19 passing, including resolver fallback, SSRF blocks, settlement-before-execution, replay, MCP and version metadata.