Honor TUN route exclusions in Android VpnService

[mysmilesnoopy]

Summary

Android constructs its VpnService routes separately from Mihomo's TUN configuration, so prefixes in tun.route-exclude-address can still be captured by the VPN. Propagate the successfully loaded exclusions into Android's route table.

Implementation

• Reuse tun.route-exclude-address for IPv4 and IPv6.
• Use VpnService.Builder.excludeRoute on Android 13+ and bounded CIDR subtraction on older versions.
• Establish routes after configuration load and replace them when exclusions change or are removed.
• Preserve empty-list behavior, disabled address families and existing package access control.

Testing

• 30 targeted tests pass: 18 route-planner, 3 reload-session, 3 JSON-bridge, 3 Go snapshot and 3 pinned-core YAML-parser tests.
• Coverage includes IPv4/IPv6, subnet and host prefixes, duplicates/overlaps, malformed input, empty exclusions, bounded output and native/fallback equivalence.
• :app:assembleAlphaDebug succeeds; the package access-control block is unchanged.
• Fresh clean-base and patched :core:lintAlphaDebug :service:lintAlphaDebug runs both report 399 existing Room-generated RestrictedApi errors (core: 0, service: 399), with zero diagnostic differences and no suppressions added.

Prior physical Android validation confirmed that excluded prefixes used the physical network, ordinary traffic continued through the VPN, and services using excluded routes could establish and re-establish with the VPN enabled.