feature: TLS passthrough will select known app_id from TXT record w multiple entries

[wwwehr]

Problem

As a phala cloud operator, I want to have two dstack-ingress instances share a
given _dstack-app-address.xxx so that I can properly route a shared hostname
using a load balancer. Currently, the router only accepts first dns record it
discovers which, also, isn't deterministic.

Fix

Extract select_app_address to iterate all values in the TXT record and return
the first whose app_id is known to the local gateway's apps map. Falls back
to the first parseable entry when none are locally known (preserves behavior
for single-instance setups).

The compat path (_tapp-address legacy) is unchanged.

Tests

• test_resolve_app_address — original live DNS integration test with mock state
• test_select_app_address_prefers_local — multi-record, picks local app_id
• test_select_app_address_fallback_when_none_local — multi-record, fallback to first