refactor(intra): migrate UDP path from PacketProxy to packetrelay

[fortuna]

Note

Stacked on #631 (Go 1.27.1 + gomobile + Outline SDK v0.1.0-rc1). Review the diff against build/upgrade-go; this PR contains no dependency changes.

Why

network.PacketProxy and network.NewPacketProxyFromPacketListener are deprecated in the Outline SDK, in favor of the flow-based network/packetrelay API. Outline did the same migration in outline-apps#2777.

This is also preparation for proxyless QUIC circumvention: retrying a blocked QUIC handshake requires a new source port (residual censorship often blackholes the flagged 4-tuple), which the relay API supports naturally by opening another association, whereas PacketProxy gives one fixed socket per session.

What changed

• intraPacketProxy → intraPacketRelay, implementing packetrelay.PacketRelay. Each association shares a dohAssociation between its sender and receiver halves (the sender needs the stack's PacketHandler to deliver locally-resolved DNS responses).
• lwip2transport.ConfigureDevice → ConfigureDeviceWithRelay.
• packetrelay.NewPacketRelayFromPacketListener(pl, 5*time.Minute) replaces NewPacketProxyFromPacketListener(…, WithPacketListenerWriteIdleTimeout(…)), preserving the RFC 4787 REQ-5 timeout. In v0.1.0-rc1 the write-idle timeout is a constructor argument, so no TimeoutPacketRelay wrapper is needed.
• Intra keeps its own DNS interception: the SDK's network/dnsintercept rewrites the destination to a remote resolver address, while Intra answers in-process via doh.Resolver.
• New packet_relay_test.go covering DNS interception (including that DNS bytes are not billed to the user), error propagation, relaying with byte accounting, association-summary reporting, and sender close semantics.

Preserved semantics: DNS-only associations are still torn down right after the query is answered; DNS traffic is still excluded from UDPSocketSummary; the summary is still reported exactly once when the association concludes.

One intentional behavior change: SendPacket on a closed association now returns packetrelay.ErrClosed for all destinations. Previously a post-close packet addressed to the fake DNS server would still issue a DoH query whose response could no longer be delivered.

Out of scope: UDPSocketSummary.Duration is documented as seconds but assigned int32(time.Since(...)) (nanoseconds, overflowing after ~2.1 s). Pre-existing on both sides of this refactor; left untouched.

Testing

• gofmt -l clean for the touched files, go vet ./...
• go test -race ./... — all packages pass
• ./gradlew :app:compileGoBackend — gomobile bind succeeds (the bound intra API surface is unchanged; only unexported types moved)