feat: add VPN DNS split routing

Implement VPN DNS discovery and split routing for intercept mode:
- Discover VPN DNS servers from F5 BIG-IP, Tailscale, Network
  Extension VPNs, and traditional VPN adapters
- Exit mode detection (split vs full tunnel) via routing table
- Interface-scoped pf exemptions for VPN DNS traffic (macOS)
- Windows VPN adapter filtering with routable address check
- AD domain controller detection with retry on transient failure
- Cleanup of stale exemptions on VPN disconnect

Squashed from intercept mode development on v1.0 branch (#497).

vpn_dns_config.go

@@ -0,0 +1,11 @@
+package ctrld
+
+// VPNDNSConfig represents DNS configuration discovered from a VPN interface.
+// Used by the dns-intercept mode to detect VPN split DNS settings and
+// route matching queries to VPN DNS servers automatically.
+type VPNDNSConfig struct {
+	InterfaceName string   // VPN adapter name (e.g., "F5 Networks VPN")
+	Servers       []string // DNS server IPs (e.g., ["10.20.30.1"])
+	Domains       []string // Search/match domains (e.g., ["corp.example.com"])
+	IsExitMode    bool     // True if this VPN is also the system default resolver (exit node mode)
+}