[codex] Add VPN provider preview

[kasnder]

Summary

This branch broadens TrackerControl's experimental WireGuard support into a provider-oriented VPN preview instead of a Mullvad-only flow.

What changed

• Added a new VPN tab with first-run onboarding, status display, provider mode switching, country selection, account setup dialogs, and custom WireGuard profile entry points.
• Added Mullvad and IVPN WireGuard profile generation, including provider country loading, local account persistence, IVPN CAPTCHA handling, reusable generated profile data, and provider key rotation support.
• Added custom WireGuard profile management so users can import, save, select, and delete WireGuard configs from other providers or self-hosted endpoints.
• Improved WireGuard egress handling and lifecycle recovery, including DNS recording in the bridge, network reload policy tests, interactive state policy tests, and bridge documentation.
• Hardened tracker-blocking privacy paths by removing the legacy filter mode, updating blocking behavior around shared IP / DNS-cloaked cases, and keeping SNI extraction disabled by default.
• Updated Gradle / build configuration and ignored local environment files used during development.
• Documented the VPN preview in README.md, including Mullvad, IVPN, custom WireGuard mode, DoH interaction, and Android's single-VPN limitation.

User impact

Users still get TrackerControl's local VPN filtering by default. Users who opt into the preview can route filtered traffic through Mullvad, IVPN, or a custom WireGuard endpoint from inside TrackerControl, without needing a second VPN app.

Validation

• ./gradlew :app:testGithubDebugUnitTest
• go test ./... from wgbridge/

Notes

• This is intentionally described as a preview because Android still permits only one active VPN service and provider flows depend on upstream provider APIs.
• The old branch name was codex/mullvad-vpn-tab; this PR uses codex/vpn-provider-preview to reflect the wider provider scope.