fix(validator): validate dns_fallback_server entries, reject URL schemes

Fallback servers must be plain UDP (IP or IP:port). Before this fix a
user could accidentally enter a DoH URL (https://...) as a fallback
server — the validator passed it through, and it silently failed at
runtime because dns_failover treats all fallback entries as UDP.

Changes:
- validator.uc: after main/bootstrap validation, check all
  dns_fallback_server values: reject entries containing '://'
  (protocol URL scheme) with a clear error, then validate each
  with dns_server_value_valid for format correctness
- config_validator_runtime.sh: assert_rejects for a DoH URL in
  dns_fallback_server

tests/config_validator_runtime.sh

@@ -259,6 +259,20 @@ cat >"$WORK_DIR/bad-dns-rule-protocol.json" <<'JSON'
 JSON
 assert_rejects "bad DNS rule protocol" "$WORK_DIR/bad-dns-rule-protocol.json" "unsupported protocol 'tcp'"
 
+cat >"$WORK_DIR/url-in-fallback-dns.json" <<'JSON'
+{
+  "settings": {
+    ".name": "settings",
+    ".type": "settings",
+    "dns_server": [ "1.1.1.1" ],
+    "bootstrap_dns_server": [ "77.88.8.8" ],
+    "dns_fallback_server": [ "https://cloudflare-dns.com/dns-query" ]
+  },
+  "section": []
+}
+JSON
+assert_rejects "URL in dns_fallback_server" "$WORK_DIR/url-in-fallback-dns.json" "Fallback DNS server"
+
 cat >"$WORK_DIR/bad-dns-rule-matchers.json" <<'JSON'
 {
   "settings": { ".name": "settings", ".type": "settings" },