fix(happ): expand happ:// links on clipboard/batch import + bump devi…

…cekit (crypt5)

ci: auto-publish general release APKs to GitHub Releases on push

Restore the fork's release behavior lost in the upstream reset:
- Re-add the "general" product flavor (clean build, no appId suffix)
- build.yml: add "Resolve release tag" step (auto v<version>-<date> tag when
  release_tag input is empty) and an ungated "Create GitHub Release" step
  (prerelease=false, overwrite_files=true) that uploads apk/general/release/*.apk
- Build assembleGeneralRelease instead of assembleRelease for releases

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Backup of master before reset to upstream 2dust/v2rayNG 2.1.5

feat(settings): toggle to disable local SOCKS5 password auth

Debug escape hatch for users reporting that device traffic dies after
the auth was introduced. When off, the local SOCKS inbound reverts to
`auth: noauth` and hev-socks5-tunnel connects without creds, matching
upstream v2rayNG behavior. Default on.

feat(root): hotspot toggle FAB, optional iptables hard-flush, disable…

… tether offload

feat(root): tether sharing, plug QUIC/UDP leak, self-heal iptables

fix(root): tunnel UDP/53 DNS through xray

feat(root): per-app split, tunnel DNS, block IPv6, ephemeral redirect…

… ports

feat: close VLESS SOCKS leak, add Root mode, expose proxy creds

- Require password auth on the local SOCKS5 inbound with stable
  per-install credentials (SecureRandom, persisted in MMKV). Closes
  the runetfreedom/per-app-split-bypass-poc vector where co-resident
  apps could reach the loopback port and learn the outbound IP.
- Thread the same credentials through hev-socks5-tunnel so our own
  tun2socks still authenticates.
- Add Root mode: V2RayRootService runs the core with a
  dokodemo-door transparent inbound and installs iptables NAT
  REDIRECT rules via su. No VpnService, no tun2socks, no SOCKS
  inbound at all — direct kernel → xray path.
- Drop the SOCKS/HTTP inbounds entirely when Root mode is active.
- Show copyable/editable proxy credentials under the mode selector
  in Settings (tap to copy, long-press to edit).

Merge remote-tracking branch 'origin/master'