feat(app): add secure routing and runtime resilience

Add explicit TUN and SOCKS5 connection modes, app routing controls, authenticated per-session local SOCKS5, Android network monitoring, persistent haptics, resilient session recovery, notification hardening and client-side Hivemind cleanup.

Keep the hosted flutter_vless_android 1.1.5 runtime as the base and apply the Android compatibility/security patches at build time instead of restoring the unstable vendored runtime.

lib/logic/crypto_service.dart

@@ -4,11 +4,17 @@ import 'package:uuid/uuid.dart';
 class CryptoService {
   static const String _deviceIdPref = 'device_uuid';
   static const _storage = FlutterSecureStorage();
+  static final RegExp _uuidV4 = RegExp(
+    r'^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$',
+    caseSensitive: false,
+  );
 
   /// Get or create a persistent device UUID for server-side session tracking.
+  /// Corrupted or tampered storage values are replaced instead of being sent
+  /// to the public API as arbitrary query data.
   static Future<String> getDeviceId() async {
     final existing = await _storage.read(key: _deviceIdPref);
-    if (existing != null) return existing;
+    if (existing != null && _uuidV4.hasMatch(existing)) return existing;
 
     final newId = const Uuid().v4();
     await _storage.write(key: _deviceIdPref, value: newId);