feat: add VPN DNS split routing

Implement VPN DNS discovery and split routing for intercept mode:
- Discover VPN DNS servers from F5 BIG-IP, Tailscale, Network
  Extension VPNs, and traditional VPN adapters
- Exit mode detection (split vs full tunnel) via routing table
- Interface-scoped pf exemptions for VPN DNS traffic (macOS)
- Windows VPN adapter filtering with routable address check
- AD domain controller detection with retry on transient failure
- Cleanup of stale exemptions on VPN disconnect

Squashed from intercept mode development on v1.0 branch (#497).

vpn_dns_others.go

@@ -0,0 +1,15 @@
+//go:build !windows && !darwin && !linux
+
+package ctrld
+
+import (
+	"context"
+)
+
+// DiscoverVPNDNS is a stub implementation for unsupported platforms.
+// Returns nil to indicate no VPN DNS configurations found.
+func DiscoverVPNDNS(ctx context.Context) []VPNDNSConfig {
+	logger := *ProxyLogger.Load()
+	Log(ctx, logger.Debug(), "VPN DNS discovery not implemented for this platform")
+	return nil
+}