…esolution

core: fix geosite.dat parsing in DNS resolver
- Replace broken GeoSiteList unmarshal with correct varint-length-delimited
  stream parser matching xray-core's format
- Add result caching to avoid re-reading the file per tag expansion

service: persist kernel exit status for proper state restoration
- Add LastKernelExitStatus (running/stopped/crashed) to DB
- Set 'running' on graceful shutdown while kernel is active so it
  is automatically restored on next startup
- Set 'stopped' when user explicitly stops the kernel via API
- Set 'crashed' when the kernel exits unexpectedly
- Check saved status at startup and log appropriate messages
- Expose lastKernelExit field via GET /api/version for the frontend

…ables sets

Two fixes for the redirect/tproxy interface exclusion feature:

1. Add missing -o/oifname rules for the OUTPUT path
   - The TP_RULE chain is jumped from both PREROUTING (tp_pre) and
     OUTPUT (tp_out). The existing -i/iifname rules only match the
     PREROUTING path correctly (packets arriving on a given interface).
   - For the OUTPUT path (locally-originated traffic), the input
     interface is always 'lo', so -i never matches the excluded
     interface. Add corresponding -o/oifname rules so that locally-
     originated traffic going out through an excluded interface is
     also bypassed (RETURN before the final REDIRECT/TPROXY action).
   - Applies to both redirect and tproxy modes, legacy iptables and
     nftables implementations, for both IPv4 and IPv6.

2. Rename nftables set 'interface'/'interface6' to 'local_ips'/'local_ips6'
   - These sets store IPv4/IPv6 addresses of local interfaces,
     dynamically maintained by the LocalIPWatcher to prevent proxy
     loops (traffic destined to local IPs returns early).
   - The old name 'interface' was misleading: it suggested it stores
     interface names, but the type is ipv4_addr/ipv6_addr.
   - The rename affects nftRedirect and nftTproxy, including the
     set definitions, chain references (ip daddr @local_ips), and
     AddIPWhitelist/RemoveIPWhitelist nft command strings.

k.GetIntegerValue() returns uint64 on Windows, but proxyEnable was
declared as uint32. Add explicit uint32() conversion to fix the
cross-compilation error:

  cannot use k.GetIntegerValue("ProxyEnable") (value of type uint64)
  as uint32 value in assignment

syscall.SetsockoptInt takes int (Linux) vs syscall.Handle (Windows)
as its first argument. The existing code used int(fd) which fails on
Windows where fd is uintptr and syscall.Handle = uintptr.

Fix: extract a platform-specific setSocketMark(fd uintptr) helper:
  - socket_unix.go (!windows) : calls SetsockoptInt(int(fd), ...)
  - socket_windows.go (windows): no-op (SO_MARK is Linux-only)