New module: IndirectSignsChecker (косвенные признаки VPN):
- NET_CAPABILITY_NOT_VPN check (absent = VPN network)
- MTU anomaly detection (VPN reduces MTU: 1500→1400 due to encapsulation)
- DNS private subnet detection (192.168.x.x/10.x.x.x may indicate VPN tunnel)
- dumpsys vpn_management / activity services VpnService probing
PortScanner: added IPv6 (::1) localhost scanning alongside IPv4 (127.0.0.1).
Some VPN apps bind only to IPv6 — now both are checked with fallback.
All findings now include technical method description, raw values,
and interpretation for better understanding of what was detected.
UI: IndirectSignsCard with per-item check/warning indicators,
section-level status badge (Чисто/Обнаружено).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
75f2ecc37d