feat: 路由模式重构(full/proxy/bypass) + CIDR动态URL获取 + 命中统计 + 连接稳定性修复

路由模式与CIDR配置重构:
- 路由模式从 full/split/custom 改为 full/proxy/bypass，移除 split 和 custom
- CIDR 按 IPv4/IPv6 分开配置，支持静态 CIDR + URL 动态获取
- URL 支持"代理前获取"(直连)和"代理后获取"(走隧道)两种时机
- 数据库迁移 v5 自动转换旧数据(custom_cidrs 拆分为 cidr_v4/v6，custom->proxy，split->full)

CIDR命中统计:
- 状态栏显示当前路由模式及 IPv4/IPv6 CIDR 命中数
- 代理模式: 显示命中/总数; 绕过模式: 显示已配置数 + 未命中目的地址数
- cidrTracker 在 pumpPackets 中逐包检查出站目的IP

连接稳定性修复(多轮):
- transport.Connect 添加 ctx 监听 goroutine，取消时关闭WS中断阻塞的ReadMessage
- auth.Login 加 context.Context 参数，可被 cancel 中断
- Disconnect() 先删路由再关TUN，避免断网窗口
- startSession 在 Connect 前释放 d.mu，避免锁持有过久
- onConnect 移除 SendStop 消除竞态
- before-proxy CIDR 获取移到 run 循环前，并行获取+5s超时，重连复用
- cidrTracker 加 RWMutex 防数据竞争

UI修复:
- CIDR URL 输入框改为水平滚动+纵向布局，防止撑宽窗口
- 路由模式为full时隐藏CIDR配置区域

internal/daemon/daemon.go

@@ -128,8 +128,8 @@ func (d *daemon) handle(conn net.Conn, req ipc.Request) {
 
 func (d *daemon) startSession(conn net.Conn, req ipc.Request) {
 	d.mu.Lock()
-	defer d.mu.Unlock()
 	if req.Config == nil {
+		d.mu.Unlock()
 		_ = ipc.WriteErr(conn, "missing config")
 		return
 	}
@@ -146,7 +146,10 @@ func (d *daemon) startSession(conn net.Conn, req ipc.Request) {
 		Token:         req.Config.Token,
 		AuthMode:      model.AuthMode(req.Config.AuthMode),
 		RoutingMode:   ipc.RoutingModeFromIPC(req.Config.RoutingMode),
-		CustomCIDRs:   req.Config.CustomCIDRs,
+		CIDRV4:        req.Config.CIDRV4,
+		CIDRV6:        req.Config.CIDRV6,
+		CIDRV4URLs:    convertIPCSources(req.Config.CIDRV4URLs),
+		CIDRV6URLs:    convertIPCSources(req.Config.CIDRV6URLs),
 		MTUOverride:   req.Config.MTUOverride,
 		TLSCACert:     req.Config.TLSCACert,
 		TLSCAPath:     req.Config.TLSCAPath,
@@ -168,10 +171,18 @@ func (d *daemon) startSession(conn net.Conn, req ipc.Request) {
 			d.server.Broadcast(ipc.Event{Event: ipc.EvError, Code: code, Message: msg})
 		},
 	)
+	// Release the lock before Connect. Connect is non-blocking (it
+	// starts a goroutine), but holding the lock across it would
+	// serialize all IPC commands (CmdStats, CmdStop, etc.) behind the
+	// session startup.
+	d.mu.Unlock()
 
 	if err := d.session.Connect(ctx, cfg); err != nil {
 		_ = ipc.WriteErr(conn, "connect: "+err.Error())
+		d.mu.Lock()
 		d.session = nil
+		d.cancel = nil
+		d.mu.Unlock()
 		return
 	}
 }
@@ -192,3 +203,18 @@ func (d *daemon) stopSessionLocked() {
 		d.session = nil
 	}
 }
+
+// convertIPCSources converts IPC CIDRURLSource values to model.CIDRURLSource.
+func convertIPCSources(srcs []ipc.CIDRURLSource) []model.CIDRURLSource {
+	if len(srcs) == 0 {
+		return nil
+	}
+	out := make([]model.CIDRURLSource, len(srcs))
+	for i, s := range srcs {
+		out[i] = model.CIDRURLSource{
+			URL:         s.URL,
+			FetchTiming: model.FetchTiming(s.FetchTiming),
+		}
+	}
+	return out
+}