feat: split-tunneling domain rules (bypass / only)

[dantraynor]

What

Adds a per-domain split-tunnel inside the extension: when an exit node is selected, the user can list domains that should either bypass the exit node (go DIRECT from the local network) or be the only domains routed through it.

UI is an inline expandable section under the existing Exit Node row in the connected view — header toggle, mode selector (Bypass / Only), one-domain-per-line textarea, Save.

Why

Closes #74.

Some sites (Microsoft Teams is the example in the issue, but Google, banks, and corp SSO portals do the same) flag traffic originating from VPN exit IPs as suspicious and either block the session or warn the account. Right now once you pick an exit node (e.g. a Mullvad one) all browser traffic goes through it — there's no escape hatch short of toggling the exit node off, which defeats the point.

How

• New DomainSplitConfig ({ mode, domains[] }) persisted under chrome.storage.local["domainSplitConfig"] and threaded through TailscaleState.
• ChromeProxyManager regenerates the PAC script when the config changes; the bypass/only check is injected after the Tailscale-mandatory branches (100.100.100.100, CGNAT, MagicDNS, subnet routes) and before the exit-node catch-all. Mandatory Tailscale traffic always proxies regardless of the rules, so the extension never breaks itself.
• FirefoxProxyManager.resolveProxy applies the same logic per request and persists the config to browser.storage.session so it survives an SW restart.
• sanitizeDomain (PAC-safe allowlist) is applied at storage write, at PAC generation, and inline in the UI on Save — anything containing characters outside [a-z0-9.-] is dropped with an inline warning. Domain matching is suffix-based, mirroring dnsDomainIs (entering microsoft.com matches both microsoft.com and *.microsoft.com).
• Rules are inert when no exit node is selected (the catch-all is DIRECT anyway).

Test

• Open Split tunneling, add microsoft.com in Bypass mode, save, pick a Mullvad exit node. Visit https://teams.microsoft.com — should not show as VPN-originating; visit https://example.com — should still come from the Mullvad IP.
• Switch the mode to Only with work.example.com saved. https://work.example.com goes through the exit, everything else goes DIRECT, but MagicDNS / Tailscale device IPs still resolve and connect.
• Reload the extension; saved rules persist.
• Paste a junk entry ("foo bar", evil"); alert("xss); save. The entry is rejected with an inline warning and never reaches the PAC.

Checklist

• pnpm test (297 unit tests pass — 15 new for sanitize/storage, 10 new for PAC + Firefox routing, 4 new for background startup / onChanged / set-domain-split)
• pnpm typecheck
• pnpm build:chrome and pnpm build:firefox
• pnpm e2e:chrome --suite=full and pnpm e2e:firefox --suite=full (new split-tunneling scenario passes; only the pre-existing exit-nodes flake fails — it expects a suggest-exit-node request that no source currently dispatches, unrelated to this change)
• Tested in Chrome (manual smoke pending)
• Tested in Firefox (manual smoke pending)
• Update README with feature inclusion

Marking draft while I finish the manual smoke pass. Happy to defer to your branch if you'd rather take it from there, I figured it'd be useful to have something to compare against.