Add DNS-over-HTTPS / DNS-over-TLS verification check

[francomano]

Description

Add a check that verifies whether DoH (DNS-over-HTTPS) and DoT (DNS-over-TLS) are actually working through the proxy. Users configure encrypted DNS but have no way to verify it is being used -- corporate environments often silently intercept it.

proxychains-ng issue #590 shows persistent pain. Firefox enables DoH by default but users cannot verify it works.

Codebase starting point

• core/checks/dns_resolve/check.go -- DNS resolution check template
• core/checks/dns_leak/check.go -- DNS leak check, shows DNS comparison pattern
• core/checks/register.go -- where to register the new check
• core/check/types.go -- CategoryProtocol already defined

Acceptance Criteria

• Create core/checks/dns_encryption/check.go implementing check.Checker
• Test DoH: POST to https://dns.google/resolve or https://cloudflare-dns.com/dns-query with a test domain, verify response
• Test DoT: TCP connection to 1.1.1.1:853 or 8.8.8.8:853 with TLS, send DNS query
• Compare results with system DNS resolution
• Check if proxy blocks DoH/DoT ports (443 for DoH, 853 for DoT)
• Depends on dns_resolve
• Register in core/checks/register.go
• Add unit tests in core/checks/dns_encryption/check_test.go
• Update README.md checks table