feat: 路由模式重构(full/proxy/bypass) + CIDR动态URL获取 + 命中统计 + 连接稳定性修复

路由模式与CIDR配置重构:
- 路由模式从 full/split/custom 改为 full/proxy/bypass，移除 split 和 custom
- CIDR 按 IPv4/IPv6 分开配置，支持静态 CIDR + URL 动态获取
- URL 支持"代理前获取"(直连)和"代理后获取"(走隧道)两种时机
- 数据库迁移 v5 自动转换旧数据(custom_cidrs 拆分为 cidr_v4/v6，custom->proxy，split->full)

CIDR命中统计:
- 状态栏显示当前路由模式及 IPv4/IPv6 CIDR 命中数
- 代理模式: 显示命中/总数; 绕过模式: 显示已配置数 + 未命中目的地址数
- cidrTracker 在 pumpPackets 中逐包检查出站目的IP

连接稳定性修复(多轮):
- transport.Connect 添加 ctx 监听 goroutine，取消时关闭WS中断阻塞的ReadMessage
- auth.Login 加 context.Context 参数，可被 cancel 中断
- Disconnect() 先删路由再关TUN，避免断网窗口
- startSession 在 Connect 前释放 d.mu，避免锁持有过久
- onConnect 移除 SendStop 消除竞态
- before-proxy CIDR 获取移到 run 循环前，并行获取+5s超时，重连复用
- cidrTracker 加 RWMutex 防数据竞争

UI修复:
- CIDR URL 输入框改为水平滚动+纵向布局，防止撑宽窗口
- 路由模式为full时隐藏CIDR配置区域

internal/model/model.go

@@ -3,6 +3,7 @@
 package model
 
 import (
+	"encoding/json"
 	"fmt"
 	"net"
 	"strings"
@@ -22,11 +23,26 @@ const (
 type RoutingMode string
 
 const (
-	RoutingFull   RoutingMode = "full"   // 0.0.0.0/0 via tunnel
-	RoutingSplit  RoutingMode = "split"  // only VPN subnet via tunnel
-	RoutingCustom RoutingMode = "custom" // user-specified CIDRs
+	RoutingFull   RoutingMode = "full"   // 全隧道: all traffic via tunnel
+	RoutingProxy  RoutingMode = "proxy"  // 代理CIDR: only specified CIDRs via tunnel
+	RoutingBypass RoutingMode = "bypass" // 绕过CIDR: all traffic via tunnel except specified CIDRs
 )
 
+// FetchTiming specifies when a CIDR URL source is fetched.
+type FetchTiming string
+
+const (
+	FetchBefore FetchTiming = "before" // before proxy: fetched via direct connection before routing is applied
+	FetchAfter  FetchTiming = "after"  // after proxy: fetched via the tunnel after the data plane is up
+)
+
+// CIDRURLSource describes a URL that provides a CIDR list. The list
+// is fetched at FetchTiming and merged into the routing configuration.
+type CIDRURLSource struct {
+	URL         string      `json:"url"`
+	FetchTiming FetchTiming `json:"fetch_timing"` // "before" or "after"
+}
+
 // ServerProfile is a saved VPN server configuration.
 type ServerProfile struct {
 	ID              int64       `json:"id"`
@@ -39,7 +55,10 @@ type ServerProfile struct {
 	Username        string      `json:"username"`
 	AuthMode        AuthMode    `json:"auth_mode"`
 	RoutingMode     RoutingMode `json:"routing_mode"`
-	CustomCIDRs     string      `json:"custom_cidrs"` // comma-separated, for RoutingCustom
+	CIDRV4          string      `json:"cidr_v4"`      // comma-separated static IPv4 CIDRs
+	CIDRV6          string      `json:"cidr_v6"`      // comma-separated static IPv6 CIDRs
+	CIDRV4URLs      string      `json:"cidr_v4_urls"` // JSON array of CIDRURLSource for IPv4
+	CIDRV6URLs      string      `json:"cidr_v6_urls"` // JSON array of CIDRURLSource for IPv6
 	MTUOverride     int         `json:"mtu_override"` // 0 = use server MTU
 	AutoConnect     bool        `json:"auto_connect"`
 	TLSCACert       string      `json:"tls_ca_cert"`      // inline CA certificate PEM (wss only)
@@ -113,6 +132,35 @@ func (p *ServerProfile) GetServerIPList() []string {
 	return valid
 }
 
+// ParseCIDRURLs decodes a JSON-encoded CIDRURLSource array. Returns an
+// empty slice if the string is empty or unparseable.
+func ParseCIDRURLs(jsonStr string) []CIDRURLSource {
+	if jsonStr == "" {
+		return nil
+	}
+	var sources []CIDRURLSource
+	if err := json.Unmarshal([]byte(jsonStr), &sources); err != nil {
+		return nil
+	}
+	return sources
+}
+
+// SplitCIDRs splits a comma-separated CIDR string into a slice,
+// trimming whitespace from each entry and skipping empty ones.
+func SplitCIDRs(s string) []string {
+	if s == "" {
+		return nil
+	}
+	var out []string
+	for _, part := range strings.Split(s, ",") {
+		c := strings.TrimSpace(part)
+		if c != "" {
+			out = append(out, c)
+		}
+	}
+	return out
+}
+
 // ConnectionStatus records the outcome of a connection attempt.
 type ConnectionStatus string