fix: route blacklist and subdomain DNS through Tor resolver

Both plugins duplicated wire-format helpers and queried the system
resolver on port 53. Switch to shared derp.dns helpers and point
queries at the local Tor DNS resolver (127.0.0.1:9053) so lookups
go through Tor like all other outbound traffic.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/derp/dns.py

@@ -17,6 +17,10 @@ RCODES: dict[int, str] = {
     4: "NOTIMP", 5: "REFUSED",
 }
 
+# Tor DNS resolver (DNSPort on the local Tor relay)
+TOR_DNS_ADDR = "127.0.0.1"
+TOR_DNS_PORT = 9053
+
 
 def get_resolver() -> str:
     """Read first IPv4 nameserver from /etc/resolv.conf."""