Release 0.3.2: Service statistics, Redis outage handling, dnscheck privacy fixes, FAQ privacy section

[MaciejTe]

• Correct name for Mikrotik RouterOS.
• docs(app): add Privacy FAQ section with QNAME minimisation and EDNS Client Subnet answers
• docs(app): explain how to get modDNS in the FAQ Basics section
• docs(app): state that QNAME minimisation is always on in the FAQ
• docs(app): refresh the FAQ last-updated date
• fix(app): Remove duplicate Limited Access banners on Account and Profile Settings pages
• fix(dnscheck): open GeoIP reader once and degrade instead of crashing on lookup failure
• chore(dnscheck): Remove unused maxmind code
• fix(dnscheck): stop storing and logging client identifiers, wire cache TTL, require CIDR IP range
• feat(dnscheck): accept a comma-separated CIDR list for the trusted IP range
• feat(dnscheck): accept a labelled comma-separated CIDR list for the trusted IP range
• fix(app,dnscheck): stop embedding the profile ID in the connection-check hostname
• test(e2e): unskip the dnscheck connection-status suite and route it inside the test stack
• fix(proxy): answer SERVFAIL on settings-store errors instead of dropping or resolving unfiltered
• feat(app): label the filter_unavailable query-log outcome
• perf(proxy): carry per-profile filter inputs on the request context from one settings batch
• feat(proxy): serve last-known-good profile settings while Redis is unreachable
• feat(libs): add an optional per-operation Redis command timeout
• fix(proxy): bound Redis command timeouts and filter store deadlines
• fix(libs): apply context deadlines to Redis socket I/O with the command timeout
• refactor(proxy): own metric label values in the metrics package
• fix(proxy): request-scoped store deadlines, transition-only outage logging, SERVFAIL on malformed DNSSEC settings
• feat(api): accept the unavailable query-log status filter
• feat(app): render and filter unavailable query-log rows
• test(proxy): add end-to-end filter pipeline benchmark against a real Redis
• feat(proxy): expose settings cache occupancy, evictions and store availability metrics
• test(proxy): reference the profile settings cache spec rows from the cache tests
• feat(api): add the unanswered query-log status filter selecting every no-answer outcome
• feat(app): replace the Unavailable logs filter with No answer and drop legacy outcome fallbacks
• fix(app): Keep group folders visible when no rules exist
• refactor(api): drop the unavailable query-log status filter value; rows are reached through unanswered
• fix(blocklists): honor $badfilter in the AdGuard extractor instead of compiling it into a block
• chore(blocklists): run main's defers before exit (gocritic exitAfterDefer)
• feat(blocklists): fail open on unsupported AdGuard modifiers and count skipped rules per reason
• test(proxy): pin profile-ID character-class validation and SNI part selection
• feat(blocklists): extract AdGuard @@ exception rules into per-source exception sets
• feat(proxy): withdraw a blocklist match covered by the list's own exception set
• feat(proxy): replace per-profile statistics with anonymous per-PoP service_statistics
• feat(api): add migration 026 clearing the legacy per-profile statistics collection
• test(e2e): cover the anonymous per-PoP service_statistics collection
• test(e2e): add pymongo, move to dnspython 2.8 and bootstrap the DoH endpoint by address
• docs(app): describe service-wide DNS statistics in the Privacy Policy
• fix(app): opt the FAQ page out of scroll anchoring
• fix(app): drop nested scroll containers from the public layout and FAQ page
• fix(app): clip collapsed FAQ answers so they stop stretching the page
• feat(proxy): store service_statistics as one hourly document per PoP with atomic increments
• docs(api): describe the service_statistics collection shape in the migrations README
• docs(app): describe service-wide DNS statistics in the Privacy Policy
• test(e2e): cover the hourly service_statistics document per PoP
• fix(app): let the empty add-rule input fill its field so browsers offer Paste
• docs(app): Update Privacy Policy
• test(e2e): read the clock once when deriving the service_statistics hour start