cli: add network fallback and explicit-only Internal Domain modes

Internal Domains now support three modes. "os" is unchanged.
"resolvers" becomes explicit resolver with network fallback: the
configured resolvers are tried first, and a timeout, unreachable
resolver, SERVFAIL or NXDOMAIN hands the query to matching VPN DNS
servers, then domain-less VPN DNS servers, then the OS resolver's LAN
nameservers through the new LanOnlyQueryCtx. "resolvers_only" keeps
the previous strict behavior. Down fallback-mode resolvers are skipped
and re-checked in the background at most every 30s. Generated upstreams
are identified by the UpstreamConfig.InternalDomain marker instead of
the internal_ key prefix.

Master adaptations: the fallback state lives on proxyRequest and is
applied in tryUpstreams, shouldContinueWithNextUpstream and
handleAllUpstreamsFailure instead of v1.0's monolithic proxy loop.
Resolver construction uses master's context-aware NewResolver, and the
background re-check marks its context private so transport errors that
name the resolver stay at debug. Tests use master's zap JSON capture
and VPN manager logger.

cmd/cli/cli.go

@@ -1207,6 +1207,7 @@ func logInternalDomainsSummary(logger *ctrld.Logger, summary internalDomainsSumm
 	event.Int("domains", summary.domains).
 		Int("os_resolver", summary.osMode).
 		Int("explicit_resolver", summary.explicit).
+		Int("explicit_resolver_only", summary.only).
 		Int("resolvers", summary.resolvers).
 		Int("skipped", summary.skipped).
 		Int("preempted", summary.preempted).