hardening: bracket a bare IPv6 nameserver literal (was unparseable -> rDNS/DNSBL silently degraded on v6-only hosts); saturating chunk-size advance in the RPC dechunker (a 16-hex-digit size could overflow-panic the worker); connclass hash= is now last-wins to match password= under parent= inheritance

src/resolver.rs

@@ -166,7 +166,12 @@ fn read_nameserver() -> String {
             if let Some(rest) = line.strip_prefix("nameserver ") {
                 let ns = rest.trim();
                 if !ns.is_empty() {
-                    return format!("{ns}:53");
+                    // bracket a bare IPv6 literal so `ns:53` parses as a SocketAddr
+                    return if ns.contains(':') && !ns.starts_with('[') {
+                        format!("[{ns}]:53")
+                    } else {
+                        format!("{ns}:53")
+                    };
                 }
             }
         }