v1.1.4 - top-position guarantee + opt-in intra-LAN

Hardening release. No change to the core fail-closed behavior.

Fixed

• Top-position guarantee (was a real leak risk). The watchdog now
  verifies our FORWARD hooks sit at the very top of the chain, not
  merely that one exists. A lone hook could otherwise end up below an
  ACCEPT that another module (e.g. a VPN routing module) inserted after
  boot, and be silently bypassed. ensure_top() re-lifts on drift,
  without opening a leak gap.
• toybox grep portability. load_ifaces() used \s, unsupported by
  Android's toybox grep -> indented comments in the interface list were
  mis-parsed. Switched to [[:space:]].

Added

• Opt-in intra-LAN exception via /data/adb/lan-killswitch.allow-lan:
  permits forwarding between local/tether interfaces while still
  rejecting non-tunnel WAN egress. Default stays full-deny. Toggle is
  picked up on the next sweep (<=10s), no reboot.

Housekeeping

• uninstall.sh also clears .debug / .allow-lan flags and the lock
  dir (user .interfaces config intentionally kept).
• README: documented the above; fixed stale "every 30s" -> 10s + link-event.

Install: Magisk Manager -> Modules -> Install from storage -> pick the zip -> reboot.