fix(routing): honor ad and app proxy policies

[LIghtJUNction]

What changed

• make ad-allow inherit the normal final policy while keeping Direct/Proxy overrides
• generate the same exact selector in jq, no-jq, migration, and bundled config paths
• add a high-priority package rule so Proxy-listed apps really use the proxy outbound
• reload sing-box after app policy changes
• update multi-app writes transactionally and keep Proxy/Bypass lists mutually exclusive
• align WebUI wording with the effective behavior

Root cause

ad-allow defaulted to Direct, so an allowed domain could still ignore the active Proxy/final policy. Per-app settings only changed TUN include/exclude fields and did not reload the running core; the Proxy list also lacked a package-to-proxy route rule.

Validation

• sh scripts/test-ad-routing.sh
• sh scripts/test-app-routing-policy.sh
• cargo test -p magicnet-cli (44 passed)
• cargo fmt --all -- --check
• npm run typecheck in webui/
• npm run build in webui/
• pre-commit run --all-files (magicnet-validate passed)
• parent and nested git diff --check
• sing-box check on bundled and generated configurations

Fixes #36
Fixes #37

Dependency: LIghtJUNction/MagicSingBox#3 (merged)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[sourcery-ai]

Sorry @LIghtJUNction, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery