fix: stop forcing port 53 on DoH/DoQ DNS server entries (#5950)

Object-form DNS server entries always received port: 53, because
DnsServerObjectInnerSchema defaulted the port unconditionally and the
DnsServerModal wire adapter always wrote it. Per Xray-core, encrypted
schemes must not carry a port field; a non-standard port is embedded in
the URL instead.

Default the port to 53 only for non-encrypted addresses and omit it for
the encrypted DNS schemes Xray dispatches without a port - https,
https+local, h2c, h2c+local and quic+local - both in the Zod schema and
in the modal's valuesToWire adapter. Schemes are matched
case-insensitively to mirror Xray-core's EqualFold comparison. A shared
isEncryptedDnsAddress helper backs both paths.

Fixes #5920

Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>

frontend/src/test/__snapshots__/dns.test.ts.snap

@@ -41,7 +41,6 @@ exports[`DnsObjectSchema fixtures > parses full byte-stably 1`] = `
       "address": "quic+local://dns.adguard.com",
       "disableCache": true,
       "finalQuery": true,
-      "port": 53,
       "serveExpiredTTL": 60,
       "serveStale": false,
       "timeoutMs": 5000,

frontend/src/test/dns.test.ts

@@ -41,3 +41,45 @@ describe('DnsServerObjectSchema fixtures', () => {
     });
   }
 });
+
+describe('DnsServerObjectSchema port defaulting', () => {
+  it('defaults port 53 for a plain address', () => {
+    const parsed = DnsServerObjectSchema.parse({ address: '8.8.8.8' });
+    expect(parsed.port).toBe(53);
+  });
+
+  it('defaults port 53 for a tcp address', () => {
+    const parsed = DnsServerObjectSchema.parse({ address: 'tcp://1.1.1.1' });
+    expect(parsed.port).toBe(53);
+  });
+
+  it('omits port for a DoH (https://) address', () => {
+    const parsed = DnsServerObjectSchema.parse({ address: 'https://cloudflare-dns.com/dns-query' });
+    expect(parsed.port).toBeUndefined();
+  });
+
+  it('omits port for a DoHL (https+local://) address', () => {
+    const parsed = DnsServerObjectSchema.parse({ address: 'https+local://dns.google/dns-query' });
+    expect(parsed.port).toBeUndefined();
+  });
+
+  it('omits port for a DoQ (quic+local://) address', () => {
+    const parsed = DnsServerObjectSchema.parse({ address: 'quic+local://dns.adguard.com' });
+    expect(parsed.port).toBeUndefined();
+  });
+
+  it('omits port for an h2c and h2c+local address', () => {
+    expect(DnsServerObjectSchema.parse({ address: 'h2c://dns.example.com/dns-query' }).port).toBeUndefined();
+    expect(DnsServerObjectSchema.parse({ address: 'h2c+local://dns.example.com/dns-query' }).port).toBeUndefined();
+  });
+
+  it('omits port for an uppercase encrypted scheme', () => {
+    const parsed = DnsServerObjectSchema.parse({ address: 'HTTPS://dns.google/dns-query' });
+    expect(parsed.port).toBeUndefined();
+  });
+
+  it('preserves an explicit port on an encrypted address', () => {
+    const parsed = DnsServerObjectSchema.parse({ address: 'https://dns.google/dns-query', port: 8443 });
+    expect(parsed.port).toBe(8443);
+  });
+});