Enhancement: Add DNSSEC signing and cache metrics

[joyider]

Summary

DNSSEC currently performs query-time signature validation and caching, but visibility into cache effectiveness is limited.

Problem

Operators cannot easily determine:

• DNSSEC cache hit rates
• DNSSEC cache miss rates
• Signature generation frequency
• Time spent generating signatures

Proposed solution

Expose metrics such as:

dnssec_cache_hits
dnssec_cache_misses
dnssec_sign_operations
dnssec_sign_duration

Metrics may be exposed through Prometheus, API endpoints, or internal statistics facilities.

Expected benefits

• Better observability
• Easier performance tuning
• Better understanding of DNSSEC overhead

Priority

Medium