(feat) quota management, transport security, and system resilience

[maybeknott]

Implement quota management, transport security, and system resilience features

- Dynamic SNI Selection Engine
Modified 'src/domain_fronter.rs' to include a destination-aware SNI mapping matrix. This engine intercepts the target host before connection establishment and selects a Google SNI hostname that mimics legitimate productivity traffic based on the request type. For example, high-bandwidth media streams (googlevideo.com) are cloaked as 'docs.google.com', while API-heavy traffic is mapped to 'developers.google.com'. Other requests are randomized across a rotation pool of common services (mail, drive, maps) to prevent the emergence of a predictable SNI fingerprint that could be flagged by DPI.

- Upstream Request Fragmentation (Reverse Chunking)
Developed a fragmentation pipeline in 'src/domain_fronter.rs' to handle outbound payloads exceeding 5 MiB. Given the ~50 MiB inbound body limit on Google Apps Script, large uploads (POST/PUT) are split into sequential fragments. Each fragment is wrapped in an envelope containing a unique 'X-MHRV-Upload-ID' and sequencing headers ('X-MHRV-Chunk-Index', 'X-MHRV-Chunk-Total'). On the backend, fragments are temporarily stored in Google Drive and reassembled once the final chunk arrives, allowing the system to support massive uploads that would otherwise exceed script execution boundaries.

- Rolling 24-Hour Quota Ledger
Implemented a thread-safe sliding-window ledger using 'Vec' for each script ID in 'src/domain_fronter.rs'. Unlike a fixed daily reset, this logic prunes expired timestamps older than 24 hours during every script selection event. This precisely mirrors Google's rolling quota reset cadence, ensuring the round-robin selector only routes traffic to scripts with verifiable capacity. This prevents the "thundering herd" problem where scripts are hit immediately after a hard reset while still being rate-limited by the backend.

- Granular Failure Classification and Quarantine
Enhanced the 'do_relay_once_with' logic to perform deep inspection of failure responses. The system now differentiates between transient network timeouts and authoritative account limits. Hard failures (HTTP 429, 403, or responses containing "Quota Exceeded") trigger a strict 24-hour quarantine window for the affected script. Transient socket errors or 5xx responses from the Google frontend trigger a brief 10-minute cooldown. This intelligent classification maximizes pool utilization by ensuring that scripts are only blacklisted for durations that match their specific failure recovery window.

- Remote DNS Enforcement and Isolation
Enforced SOCKS5 remote DNS resolution (Address Type 0x03) within 'src/proxy_server.rs' to eliminate domain leakage. The proxy intercepts connection attempts and passes the raw hostname directly to the encrypted tunnel, bypassing 'std::net::ToSocketAddrs' and other local resolution bindings. This ensures that destination metadata is never exposed via plaintext DNS queries to local ISP servers, maintaining full end-to-end privacy for the target hostnames.

- System Proxy Self-Healing and Watchdog
Established a dual-layer preservation strategy for Windows system proxy settings in 'src/main.rs'. A global panic hook using 'std::panic::set_hook' is registered to forcefully clear the 'ProxyEnable' and 'ProxyServer' registry keys during any unhandled exception. Complementing this, a boot-initialization routine flushes orphaned proxy settings from previous ungraceful exits. This self-healing architecture prevents the system's network configuration from being left in a broken state if the process is terminated via power loss or task termination.

- WinINet System Proxy Synchronization
Integrated direct Win32 FFI bindings to 'InternetSetOptionW' in 'src/bin/ui.rs' to ensure registry changes are propagated instantly. By broadcasting the 'INTERNET_OPTION_SETTINGS_CHANGED' and 'INTERNET_OPTION_REFRESH' flags, the OS network subsystem notifies active applications (such as Chrome, Edge, and background services) to flush their proxy caches. This provides seamless, real-time toggling of the system proxy state without requiring browser restarts or waiting for OS-level cache timeouts.

- Local Traffic Filtering (block_hosts)
Added a local interception gate in 'src/proxy_server.rs' that matches destination hosts against a 'block_hosts' configuration. Requests to trackers, ads, and telemetry endpoints (identified by exact match or suffix) are short-circuited with a 204 No Content response locally. This proactive filtering preserves the user's limited Apps Script execution quota for meaningful content and reduces overall latency by eliminating unnecessary remote round-trips for non-essential traffic.

- UI Modernization and Live Progress Tracking
Overhauled 'src/bin/ui.rs' with a high-contrast 'Obsidian' theme and real-time operational metrics. The interface now features a live 'ProgressBar' bound to the sliding-window ledger to visualize quota consumption. Status indicators were updated with sine-wave-driven alpha pulsing to provide interactive feedback on background connection states, while informational blocks were added to provide technical context on local loopback decryption and certificate sandboxing.

- Technical Fixes and Maintenance
Resolved a compatibility issue in 'src/main.rs' and 'src/bin/ui.rs' by migrating 'RegKey::predefined' calls to the modern 'RegKey::predef' API as required by the latest 'winreg' library. Fixed a '#[warn(unused_variables)]' warning by removing the unused variable 'n' in the 'next_script_id' implementation in 'src/domain_fronter.rs'.