fix: parallel DNS resolution and robust domain addition

[GeiserX]

Summary

• Parallel DNS with trust hierarchy: dig and DoH now race simultaneously, but dig-based resolvers get a 200ms head start. When VPN blocks UDP DNS, DoH wins in ~2s instead of waiting 8+ seconds for sequential dig timeouts. When DNS works normally, trusted local resolvers win before DoH even fires.
• Fix addDomain hosts/cache gap: applyRoutesForDomain now populates dnsCache and dnsDiskCache immediately, and addDomain updates /etc/hosts on success — previously hosts entries were only created during periodic refresh.
• Tracked auto-retry on failure: When DNS fails on domain addition, a 15-second retry is scheduled with proper cancellation support. Retries read the current gateway (not stale captured value), check for duplicate routes, and set isApplyingRoutes correctly.
• Hardening: failedDomains changed to Set (prevents unbounded growth), setAllDomainsEnabled does a single disk write instead of N, toggleDomain now updates hosts file, redundant MainActor.run wrappers removed, retry tasks cancelled on VPN disconnect/domain removal.

Test plan

• Build succeeds (release mode)
• App launches, detects VPN, applies routes from cache
• Background DNS refresh completes and updates routes
• /etc/hosts file populated with domain→IP mappings
• Routing table has entries through real gateway (192.168.10.1)
• DNS cache file populated on disk
• Add a custom domain while connected to VPN — should resolve and route within ~2 seconds
• Verify log shows warning + retry when DNS resolution fails
• Remove domain during retry window — retry should be cancelled
• Toggle domain on/off — routes added/removed, hosts file updated
• Enable All domains — should not thrash disk (single save)
• VPN disconnect clears routes and cancels pending retries