perf: 路由批量执行+CIDR聚合+并行脚本+连接步骤显示+CIDR刷新按钮

路由性能优化:
- 修复 macOS route 命令语法错误（去掉 -net 参数）
- 路由应用拆分为 Essential（ready前，4-6条命令<1s）+ Deferred（ready后，批量脚本）
- 新增 CIDR 聚合算法（cidrmerge.go），合并相邻 CIDR 块减少路由数量（10826->7500）
- 批量脚本执行：3平台各实现8个批量函数，临时脚本单次执行替代逐条进程创建
- 并行批量：拆为4个子shell并行执行，总时间降为1/4

连接步骤显示:
- stats 新增 connectStep + cidrError 原子变量
- 连接生命周期中设置步骤（fetch_cidrs/connecting/load_routes），UI 实时显示
- after-proxy CIDR 获取期间显示加载状态，获取失败显示错误提示

CIDR 刷新按钮:
- ipc 新增 CmdRefreshCIDR 命令
- daemon 处理刷新请求，session.RefreshCIDRs() 重新获取+添加路由
- UI 状态卡新增刷新按钮，proxy/bypass 模式已连接时显示

README:
- 补充 URL 获取时机注意事项（bypass模式after-proxy可能失败）
- 补充 CIDR 聚合与批量执行说明

internal/stats/stats.go

@@ -34,6 +34,9 @@ type Stats struct {
 	state       atomic.Value // State
 	assignedIP  atomic.Value // string (IPv4)
 	assignedIP6 atomic.Value // string (IPv6, may be empty)
+	routeLoading atomic.Bool  // true while deferred routes are being applied
+	connectStep  atomic.Value // string (human-readable connection step)
+	cidrError    atomic.Value // string (CIDR fetch error message, empty = no error)
 }
 
 // AddRx records a downloaded packet (WebSocket → TUN) of length n,
@@ -76,6 +79,8 @@ func New() *Stats {
 	s.state.Store(StateDisconnected)
 	s.assignedIP.Store("")
 	s.assignedIP6.Store("")
+	s.connectStep.Store("")
+	s.cidrError.Store("")
 	return s
 }
 
@@ -100,6 +105,42 @@ func (s *Stats) SetDisconnected() {
 	s.assignedIP.Store("")
 	s.assignedIP6.Store("")
 	s.state.Store(StateDisconnected)
+	s.routeLoading.Store(false)
+	s.connectStep.Store("")
+	s.cidrError.Store("")
+}
+
+// SetRouteLoading sets whether deferred routes are currently being
+// applied (e.g. thousands of CIDR bypass routes being added in the
+// background after the tunnel is up).
+func (s *Stats) SetRouteLoading(loading bool) { s.routeLoading.Store(loading) }
+
+// RouteLoading returns whether deferred routes are being applied.
+func (s *Stats) RouteLoading() bool { return s.routeLoading.Load() }
+
+// SetConnectStep sets a human-readable description of the current
+// connection step (e.g. "fetching CIDR lists"). Empty clears it.
+func (s *Stats) SetConnectStep(step string) { s.connectStep.Store(step) }
+
+// ConnectStep returns the current connection step description.
+func (s *Stats) ConnectStep() string {
+	v := s.connectStep.Load()
+	if v == nil {
+		return ""
+	}
+	return v.(string)
+}
+
+// SetCIDRError sets a CIDR fetch error message (empty = no error).
+func (s *Stats) SetCIDRError(msg string) { s.cidrError.Store(msg) }
+
+// CIDRError returns the current CIDR fetch error message.
+func (s *Stats) CIDRError() string {
+	v := s.cidrError.Load()
+	if v == nil {
+		return ""
+	}
+	return v.(string)
 }
 
 // AssignedIP returns the server-assigned tunnel IPv4.
@@ -137,11 +178,14 @@ type Snapshot struct {
 	Uptime      time.Duration
 
 	// Routing info (filled by SessionManager.reportStats).
-	RoutingMode string `json:"routing_mode,omitempty"` // "full", "proxy", "bypass"
-	CIDRV4Total int    `json:"cidr_v4_total,omitempty"`
-	CIDRV4Hits  int    `json:"cidr_v4_hits,omitempty"`
-	CIDRV6Total int    `json:"cidr_v6_total,omitempty"`
-	CIDRV6Hits  int    `json:"cidr_v6_hits,omitempty"`
+	RoutingMode  string `json:"routing_mode,omitempty"` // "full", "proxy", "bypass"
+	CIDRV4Total  int    `json:"cidr_v4_total,omitempty"`
+	CIDRV4Hits   int    `json:"cidr_v4_hits,omitempty"`
+	CIDRV6Total  int    `json:"cidr_v6_total,omitempty"`
+	CIDRV6Hits   int    `json:"cidr_v6_hits,omitempty"`
+	RouteLoading bool   `json:"route_loading,omitempty"` // deferred routes being applied
+	ConnectStep  string `json:"connect_step,omitempty"` // current connection step
+	CIDRError    string `json:"cidr_error,omitempty"`   // CIDR fetch error message
 }
 
 // Snapshot returns a point-in-time copy of the statistics.
@@ -166,5 +210,8 @@ func (s *Stats) Snapshot() Snapshot {
 		snap.ConnectedAt = time.Unix(ts, 0)
 		snap.Uptime = time.Since(snap.ConnectedAt)
 	}
+	snap.RouteLoading = s.routeLoading.Load()
+	snap.ConnectStep = s.ConnectStep()
+	snap.CIDRError = s.CIDRError()
 	return snap
 }