feat(android): add per-app Tor routing with isolated DNS and bridge support

[billuwdev]

Summary

This PR adds an Android Tor module with per-app routing, DNS isolation,
bridge support, runtime status, and traffic statistics.

Only applications explicitly enabled for both VPN and Tor are routed through
Tor. Other VPN applications continue using the regular VPN route and DNS path.

Changes

• Embed the Tor runtime, GeoIP data, and obfs4 transport for Android arm64.
• Add direct, built-in obfs4, and custom obfs4 bridge configuration.
• Add a local Tor SOCKS, control, and DNS service.
• Inject a tor-out SOCKS outbound and per-package routing rules into Mihomo.
• Route DNS requests from Tor-enabled applications through Tor DNSPort.
• Keep regular VPN application DNS on the normal VPN DNS path.
• Prevent bridge and upstream proxy traffic from being routed back into Tor.
• Add Tor startup progress, exit IP, request latency, and traffic statistics.
• Add per-app VPN and Tor controls.
• Sort applications by:
  1. Tor-enabled applications
  2. VPN-enabled applications
  3. Direct applications
• Make application selection update immediately and cache application icons.
• Remove Tor selection automatically when VPN access is removed.
• Fix an Android process crash when stopping VPN while Tor is running.
• Add the Tor module product and architecture document.

Core Changes

This PR modifies the vendored Mihomo core DNS hijack path.

The TUN DNS handler resolves the source Android package name and forwards DNS
packets to 127.0.0.1:19053 only when that package is present in the Tor
package set. All other DNS packets continue through the existing Mihomo DNS
relay.

Tor routing state is passed from Flutter to the core using an atomic package
state container.

Traffic Flow

Tor application TCP
  -> Android VPN
  -> Mihomo tor-out
  -> Tor SOCKS 127.0.0.1:19050
  -> Tor network

Tor application DNS
  -> Android VPN DNS hijack
  -> Tor DNSPort 127.0.0.1:19053
  -> Tor network

Regular VPN application
  -> Android VPN
  -> Existing Mihomo rules and DNS