Harden Pattern, DNS, and Advanced runtime state

[lulushuz]

What changed

• Makes whitelist configuration fail closed and canonicalizes domains in Rust.
• Removes hidden alias expansion and serializes Pattern/DNS synchronization.
• Makes settings persistence single-writer and ignores stale UI responses.
• Wires the DNS Watchdog toggle to runtime and replaces HTTP HEAD checks with real DoH/DoT resolution probes.
• Verifies and rolls back DNS Kill Switch changes when engine startup fails.
• Preserves Advanced arguments safely, rejects invalid numeric values, and marks unimplemented TPWS/IPSet features unavailable.
• Adds clearer EN/TR runtime logs, CI verification, changelog entries, and an architecture audit report.

Root causes

The frontend and Rust independently wrote the same settings file, debounced IPC requests could complete out of order, malformed persisted Pattern settings silently fell back to all-sites mode, and several UI settings were not connected to the runtime behavior they described.

Validation

• cargo test --lib — 22 tests passed
• cargo clippy --lib -- -D warnings — passed
• npm run build — passed

Manual acceptance still required

The elevated Windows firewall, adapter DNS, child command-line, and real traffic matrix is documented in docs/AUDIT_2.0.8.md. Keep this PR as draft until those checks are completed.