fix: block DoH by default + fix Android tunnel_doh config mismatch

[yyoyoian-pixel]

Summary

• Block DoH (block_doh: true): immediately reject connections to known DoH endpoints (chrome.cloudflare-dns.com, dns.google, etc.). Browsers fall back to system DNS, which tun2proxy handles via virtual DNS — instant, zero tunnel cost. Saves ~1.5s per domain lookup vs tunneling DoH through Apps Script.
• Fix Android config mismatch: tunnelDoh defaulted to false on Android but true on Rust. When Android omitted the field (default = don't emit), Rust used its own default (true) — so bypass_doh was silently broken on Android. Now Android always emits tunnel_doh explicitly and defaults match Rust.
• Android UI toggles: Block DoH and Bypass DoH in Advanced settings. Block takes priority over Bypass.

Context

PR #468 changed tunnel_doh to true because Iranian ISPs block direct DoH endpoints. This was the right call for censorship resistance, but it made every page load ~1.5s slower per domain (Chrome's DoH connections now traversed the full Apps Script tunnel). block_doh solves both problems: no ISP-visible DoH connection (the connection never leaves the device), no tunnel round-trip (system DNS is instant via tun2proxy virtual DNS).

Test plan

• Tested on Pixel 6 Pro with full-mode tunnel
• Zero chrome.cloudflare-dns.com tunnel sessions with block_doh=true
• Chrome/Brave fall back to virtual DNS correctly
• Pages load without DoH overhead
• Block DoH toggle works in Android Advanced UI
• Bypass DoH is disabled (grayed out) when Block DoH is on

🤖 Generated with Claude Code

[therealaleph]

@yyoyoian-pixel — reviewed locally (179 lib + 35 tunnel-node tests still pass). Merging.

The DoH block is the right call — DoH-via-Apps-Script was wasting tunnel quota on a use case (encrypted DNS) where browsers will happily fall back to system DNS, which tun2proxy resolves via virtual DNS at zero cost. The Block > Bypass priority + the disabled Bypass switch when Block is on is a good UX pattern.

The Android tunnelDoh mismatch fix is a real bug: defaulting false Android-side meant the field never serialized, so Rust used its own true default and bypass_doh_hosts matching was broken on every fresh Android install. Glad you caught it.

Will ship in the next release.

---

_{[reply via Anthropic Claude | reviewed by @therealaleph]}