feat: 路由模式重构(full/proxy/bypass) + CIDR动态URL获取 + 命中统计 + 连接稳定性修复

路由模式与CIDR配置重构:
- 路由模式从 full/split/custom 改为 full/proxy/bypass，移除 split 和 custom
- CIDR 按 IPv4/IPv6 分开配置，支持静态 CIDR + URL 动态获取
- URL 支持"代理前获取"(直连)和"代理后获取"(走隧道)两种时机
- 数据库迁移 v5 自动转换旧数据(custom_cidrs 拆分为 cidr_v4/v6，custom->proxy，split->full)

CIDR命中统计:
- 状态栏显示当前路由模式及 IPv4/IPv6 CIDR 命中数
- 代理模式: 显示命中/总数; 绕过模式: 显示已配置数 + 未命中目的地址数
- cidrTracker 在 pumpPackets 中逐包检查出站目的IP

连接稳定性修复(多轮):
- transport.Connect 添加 ctx 监听 goroutine，取消时关闭WS中断阻塞的ReadMessage
- auth.Login 加 context.Context 参数，可被 cancel 中断
- Disconnect() 先删路由再关TUN，避免断网窗口
- startSession 在 Connect 前释放 d.mu，避免锁持有过久
- onConnect 移除 SendStop 消除竞态
- before-proxy CIDR 获取移到 run 循环前，并行获取+5s超时，重连复用
- cidrTracker 加 RWMutex 防数据竞争

UI修复:
- CIDR URL 输入框改为水平滚动+纵向布局，防止撑宽窗口
- 路由模式为full时隐藏CIDR配置区域

internal/transport/transport.go

@@ -89,12 +89,26 @@ func Connect(ctx context.Context, cfg HandshakeConfig) (*Conn, error) {
 
 	ws.SetReadLimit(protocol.MaxMessageSize)
 
+	// Watch ctx and close the WS if it is cancelled. This unblocks all
+	// ReadMessage/WriteMessage calls (they only use SetReadDeadline,
+	// not ctx). The goroutine exits when connectDone is closed (on
+	// either success or failure) to avoid leaking.
+	connectDone := make(chan struct{})
+	go func() {
+		select {
+		case <-ctx.Done():
+			ws.Close()
+		case <-connectDone:
+		}
+	}()
+
 	conn := &Conn{ws: ws}
 
 	// Step 2: authenticate (only for password mode; JWT is validated
 	// during the WS upgrade).
 	if cfg.Token == "" {
 		if err := conn.passwordAuth(cfg.Username, cfg.Password); err != nil {
+			close(connectDone)
 			ws.Close()
 			return nil, err
 		}
@@ -103,6 +117,7 @@ func Connect(ctx context.Context, cfg HandshakeConfig) (*Conn, error) {
 	// Step 3: receive init (or error/auth_err).
 	initMsg, err := conn.readInit()
 	if err != nil {
+		close(connectDone)
 		ws.Close()
 		return nil, err
 	}
@@ -111,6 +126,7 @@ func Connect(ctx context.Context, cfg HandshakeConfig) (*Conn, error) {
 	// Step 4: configure TUN via callback.
 	if cfg.OnInit != nil {
 		if err := cfg.OnInit(initMsg); err != nil {
+			close(connectDone)
 			ws.Close()
 			return nil, fmt.Errorf("tun configure: %w", err)
 		}
@@ -118,10 +134,15 @@ func Connect(ctx context.Context, cfg HandshakeConfig) (*Conn, error) {
 
 	// Step 5: send ready.
 	if err := conn.sendReady(); err != nil {
+		close(connectDone)
 		ws.Close()
 		return nil, fmt.Errorf("send ready: %w", err)
 	}
 
+	// Handshake complete - stop the ctx watcher so it doesn't close
+	// the connection after we return it to the caller.
+	close(connectDone)
+
 	// Step 6: set up keepalive — reset read deadline on each server
 	// ping, and auto-respond with pong (allowed via WriteControl in
 	// handler — see gorilla/websocket docs).