refactor(intra): use the SDK's dnsintercept relay for DoH interception

[fortuna]

Warning

Do not merge yet. This depends on OutlineFoundation/outline-sdk#637, which is still
a draft. go.mod currently pins the SDK to the branch commit
v0.1.0-rc1.0.20260915234250-3f66d9c28049; it must be repointed at a released version
before this can land.

What

Intra's UDP path used to do its own DNS interception: intraPacketRelay compared every
destination against the fake DNS address, and ran the DoH query inline. The Outline SDK now
ships that behavior as a composable decorator, so this PR deletes Intra's copy and composes
the SDK one instead:

pr, err := newIntraPacketRelay(protector, eventListener)  // relays UDP, counts bytes
dnsRelay := dnsintercept.New(pr, fakeDNSAddr, dns.FuncExchanger(t.queryDNS),
    dnsintercept.WithErrorHandler(...))
lwip2transport.ConfigureDeviceWithRelay(t.sd, dnsRelay)

Android/app/src/go/intra/packet_relay.go is now nothing but byte accounting and
UDPSocketSummary reporting. The swappable DoH resolver moved from the relay to the
Tunnel, which exposes it as a dns.Exchanger (Tunnel.queryDNS) — doh.Resolver.Query
already has the wire-format signature the SDK expects.

Why

The interception logic is not Intra-specific; the only thing Intra needed that the SDK
lacked was a way to plug in its own resolver. The SDK PR adds dns.Exchanger for exactly
that, so both Intra and the Outline Client can share one implementation — and Intra gets the
SDK's ref-counted association lifetime for free.

Behavior changes

	Before	After
DoH query	ran synchronously inside SendPacket, blocking the lwIP callback	runs on its own goroutine; SendPacket returns immediately
DoH failure	returned as a SendPacket error (which lwIP discards)	passed to WithErrorHandler → logging.Warnf
Query cancellation	tunnel context only	association context and tunnel context (context.AfterFunc)
DNS-only association	reported a UDPSocketSummary with zero bytes	opens no UDP socket, so reports nothing
DNS byte exclusion	explicit (if isEquivalentAddrPort(...) before the counters)	structural: DNS never reaches the counting relay

The dropped zero-byte summaries are not a telemetry change: IntraVpnService already
discards summaries below 10,000 bytes.

Tests

packet_relay_test.go keeps the relaying/accounting/close-semantics tests and gains
TestInterceptedDNSIsNotRelayed, which exercises the exact composition NewTunnel builds.
The new tunnel_test.go covers the exchanger adapter: it always reads the current resolver
(so SetDNS takes effect immediately) and in-flight queries are canceled on disconnect.

• gofmt -l . — clean (except the pre-existing intra/split/retrier.go)
• go vet ./..., go test -race ./...
• ./gradlew :app:compileGoBackend