feat(ios): full-tunnel VPN app — UI parity, build fix, SNI pool

iOS NetworkExtension full-tunnel client (leaf + FakeIP -> SOCKS5 -> mhrv-rs):

- Build: produce the static lib via `cargo rustc --crate-type staticlib`.
  `cargo build --lib` also links the cdylib, which fails on iOS
  (undefined ___chkstk_darwin under -nodefaultlibs), aborting the build
  and leaving a stale .a so device builds never picked up changes.
- utun fd: getsockopt(UTUN_OPT_IFNAME) fallback when the KVC keypath
  returns nil (newer iOS), plus dup() so leaf owns the fd independently.
- leaf log level "none" so leaf's tracing init doesn't panic against the
  already-installed global subscriber; panic hook logs payload + location.
- UI: full-tunnel mode, multi deployment IDs, auth key show/hide, SNI pool
  editor with per-SNI TLS probe, auto-detect Google IP, QUIC/STUN/DoH toggles.
- Config import: mhrv-rs:// (zlib) + JSON/TOML, Android-compatible.
- Signing team read from a gitignored Local.xcconfig (no team ID in VCS);
  generated .xcodeproj and build/ are gitignored.
- App icon; version from MARKETING_VERSION; iOS README incl. TestFlight steps.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: yyoyoian-pixel

.cargo/config.toml

@@ -0,0 +1,27 @@
+# Per-target rustflags for cross-compilation.
+#
+# iOS staticlib build (aarch64-apple-ios):
+#   -C panic=abort — propagate abort strategy to all crates so they match the
+#   [profile.release] panic = "abort" setting in Cargo.toml. Without this,
+#   leaf-ffi (which has its own staticlib crate-type) links panic_unwind and
+#   conflicts with our abort-strategy staticlib.
+# IPHONEOS_DEPLOYMENT_TARGET=16.0 is required so the linker doesn't default
+# to iOS 10 and produce version-mismatch errors with leaf's netstack-lwip C
+# objects (which are compiled against the current Xcode SDK).
+[target.aarch64-apple-ios]
+rustflags = []
+
+[target.aarch64-apple-ios.env]
+IPHONEOS_DEPLOYMENT_TARGET = "16.0"
+
+[target.aarch64-apple-ios-sim]
+rustflags = []
+
+[target.aarch64-apple-ios-sim.env]
+IPHONEOS_DEPLOYMENT_TARGET = "16.0"
+
+[target.x86_64-apple-ios]
+rustflags = []
+
+[target.x86_64-apple-ios.env]
+IPHONEOS_DEPLOYMENT_TARGET = "16.0"

.gitignore

@@ -4,3 +4,8 @@
 /config.json
 .DS_Store
 /SCR-*.png
+
+# iOS — generated by xcodegen / Xcode, and local signing (never commit team ID)
+/ios/MhrvVPN.xcodeproj/
+/ios/build/
+/ios/Local.xcconfig