feat: fallback to ICANN endpoint for native clients when Pubky TLS is unreachable

[francismars]

This PR adds native SDK fallback to ICANN HTTPS when Pubky TLS is unreachable.

Why

Native clients can fail to reach Pubky-host endpoints when a homeserver is behind Cloudflare Tunnel, NAT, or other proxy/network setups. In these cases, PKARR may advertise a Pubky TLS endpoint that is not reachable from the client network, while the ICANN HTTPS endpoint is reachable.

What changed

In pubky-sdk/src/client/http_targets/native.rs:

• Added native fallback logic in cross_request:
  • Keep normal Pubky TLS path for Pubky hosts.
  • If Pubky TLS endpoint is unreachable, fallback to ICANN HTTPS endpoint and attach pubky-host header.
• Added endpoint resolution + reachability probe helpers:
  • Resolve PKARR HTTPS endpoints for the target key.
  • Probe Pubky TLS endpoint via TCP with a 3s timeout.
  • Use ICANN endpoint when probe fails and ICANN endpoint exists.
• Tightened host handling parity:
  • Malformed _pubky.* now routes to ICANN handling instead of falling through to Pubky TLS.
• Added native regression tests for:
  • malformed _pubky.* classification
  • rejection of pubky<z32> transport host in prepare_request
  • rejection of _pubky.pubky<z32> via cross_request
  • fallback/no-fallback behavior for unreachable/reachable Pubky TLS endpoints

Behavior summary

• Before: Native requests to Pubky hosts preferred Pubky TLS and could fail when that endpoint was unreachable from the client network.
• After: Native requests still prefer Pubky TLS, but automatically fallback to ICANN HTTPS when Pubky TLS is not reachable.

Test plan

• cargo test -p pubky --lib http_targets::native -- --nocapture ✅
• cargo clippy -p pubky -- -D warnings ✅
• Manual SDK E2E (no Ring build): ✅
  • Ran a temporary native SDK signup binary against Umbrel + Cloudflare homeserver using signup token.
  • Signup succeeded and returned valid session info.

Scope / non-goals

• No Ring app changes in this PR.
• No change to WASM path.
• No change to PKARR publishing format; this is client-side routing/fallback behavior only.

[francismars]

@SeverinAlexB please review 🤲