feat: 路由模式重构(full/proxy/bypass) + CIDR动态URL获取 + 命中统计 + 连接稳定性修复

路由模式与CIDR配置重构:
- 路由模式从 full/split/custom 改为 full/proxy/bypass，移除 split 和 custom
- CIDR 按 IPv4/IPv6 分开配置，支持静态 CIDR + URL 动态获取
- URL 支持"代理前获取"(直连)和"代理后获取"(走隧道)两种时机
- 数据库迁移 v5 自动转换旧数据(custom_cidrs 拆分为 cidr_v4/v6，custom->proxy，split->full)

CIDR命中统计:
- 状态栏显示当前路由模式及 IPv4/IPv6 CIDR 命中数
- 代理模式: 显示命中/总数; 绕过模式: 显示已配置数 + 未命中目的地址数
- cidrTracker 在 pumpPackets 中逐包检查出站目的IP

连接稳定性修复(多轮):
- transport.Connect 添加 ctx 监听 goroutine，取消时关闭WS中断阻塞的ReadMessage
- auth.Login 加 context.Context 参数，可被 cancel 中断
- Disconnect() 先删路由再关TUN，避免断网窗口
- startSession 在 Connect 前释放 d.mu，避免锁持有过久
- onConnect 移除 SendStop 消除竞态
- before-proxy CIDR 获取移到 run 循环前，并行获取+5s超时，重连复用
- cidrTracker 加 RWMutex 防数据竞争

UI修复:
- CIDR URL 输入框改为水平滚动+纵向布局，防止撑宽窗口
- 路由模式为full时隐藏CIDR配置区域

internal/ipc/ipc.go

@@ -49,20 +49,31 @@ type Request struct {
 // vpn.SessionConfig but is kept separate to avoid importing the vpn
 // package (which needs root-only TUN) into the GUI.
 type ClientConfig struct {
-	ServerURL     string   `json:"server_url"`
-	SNIHost       string   `json:"sni_host"`        // TLS SNI hostname for CDN
-	ServerIPs     []string `json:"server_ips"`      // CDN edge IP list for failover
-	Username      string   `json:"username"`
-	Password      string   `json:"password"`
-	Token         string   `json:"token"`
-	AuthMode      string   `json:"auth_mode"`
-	RoutingMode   string   `json:"routing_mode"`
-	CustomCIDRs   []string `json:"custom_cidrs"`
-	MTUOverride   int      `json:"mtu_override"`
-	TLSCACert     string   `json:"tls_ca_cert"`     // inline CA cert PEM (wss only)
-	TLSCAPath     string   `json:"tls_ca_path"`     // CA cert file path (wss only)
-	TLSInsecure   bool     `json:"tls_insecure"`    // skip cert verification (wss only)
-	TLSPinnedHash string   `json:"tls_pinned_hash"` // SHA-256 cert pin (wss only)
+	ServerURL     string          `json:"server_url"`
+	SNIHost       string          `json:"sni_host"`        // TLS SNI hostname for CDN
+	ServerIPs     []string        `json:"server_ips"`      // CDN edge IP list for failover
+	Username      string          `json:"username"`
+	Password      string          `json:"password"`
+	Token         string          `json:"token"`
+	AuthMode      string          `json:"auth_mode"`
+	RoutingMode   string          `json:"routing_mode"`    // "full", "proxy", "bypass"
+	CIDRV4        []string        `json:"cidr_v4"`         // static IPv4 CIDRs
+	CIDRV6        []string        `json:"cidr_v6"`         // static IPv6 CIDRs
+	CIDRV4URLs    []CIDRURLSource `json:"cidr_v4_urls"`   // IPv4 CIDR URL sources
+	CIDRV6URLs    []CIDRURLSource `json:"cidr_v6_urls"`   // IPv6 CIDR URL sources
+	MTUOverride   int             `json:"mtu_override"`
+	TLSCACert     string          `json:"tls_ca_cert"`     // inline CA cert PEM (wss only)
+	TLSCAPath     string          `json:"tls_ca_path"`     // CA cert file path (wss only)
+	TLSInsecure   bool            `json:"tls_insecure"`    // skip cert verification (wss only)
+	TLSPinnedHash string          `json:"tls_pinned_hash"` // SHA-256 cert pin (wss only)
+}
+
+// CIDRURLSource describes a URL that provides a CIDR list. It mirrors
+// model.CIDRURLSource but is kept here to avoid importing the model
+// package into the IPC wire format.
+type CIDRURLSource struct {
+	URL         string `json:"url"`
+	FetchTiming string `json:"fetch_timing"` // "before" or "after"
 }
 
 // Event is a notification from the daemon to the GUI.
@@ -285,10 +296,10 @@ func RoutingModeFromIPC(s string) route.Mode {
 	switch s {
 	case "full":
 		return route.ModeFull
-	case "split":
-		return route.ModeSplit
-	case "custom":
-		return route.ModeCustom
+	case "proxy":
+		return route.ModeProxy
+	case "bypass":
+		return route.ModeBypass
 	default:
 		return route.ModeFull
 	}