fix: retry on DNS timeout, distinguish authoritative negatives (closes #35)

- Add StatusTimeout constant for timeout responses
- querySingleType now retries on timeout and SERVFAIL (3 attempts,
  exponential backoff starting at 100ms)
- NXDOMAIN and NOERROR+empty are treated as authoritative negatives
  with no retry
- classifyResponse sets structured error messages for timeout and
  SERVFAIL cases
- Refactored into smaller functions to satisfy cyclomatic complexity
  limits

internal/resolver/errors.go

@@ -24,4 +24,8 @@ var (
 	// ErrContextCanceled wraps context cancellation for the
 	// resolver's iterative queries.
 	ErrContextCanceled = errors.New("context canceled")
+
+	// ErrSERVFAIL is returned when a DNS server responds with
+	// SERVFAIL after all retries are exhausted.
+	ErrSERVFAIL = errors.New("SERVFAIL from server")
 )