Fix code review issues: timeouts, RootHints fallback, upstream validation, Unix comment

- Fix ReadTimeout/WriteTimeout to use 5*time.Second instead of 5 (nanoseconds)
- Add RootHints fallback in DiscoverRoots() when queryResolver fails
- Validate --dns-upstream is a valid host:port in Config.Validate()
- Update systemResolver() comment to note it is Unix-only (/etc/resolv.conf)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: multica-agent <github@multica.ai>

internal/config/config.go

@@ -130,6 +130,12 @@ func (c *Config) Validate() error {
 		return ErrAlwaysTCPRequiresTCP
 	}
 
+	if c.DNSUpstream != "" {
+		if _, _, err := net.SplitHostPort(c.DNSUpstream); err != nil {
+			return fmt.Errorf("--dns-upstream %q is not a valid host:port address", c.DNSUpstream)
+		}
+	}
+
 	return nil
 }