fix(vpn): IPv6 CONNECT parse, native Int port storage, malformed-intent guard (#019)

[Hidden-Node]

Three independent latent bugs that fail silently or with confusing
symptoms on the internet-sharing + connect paths:

• IPv6-literal HTTP CONNECT: the HTTP proxy split CONNECT [::1]:443
  on : and took host = "[", silently failing every IPv6-literal
  CONNECT (browser showed "connection failed" with no diagnostic).
  Replaced the inline split with a parseConnectTarget helper on
  MasterDnsVpnService.companion that handles bracketed IPv6 literals
  and a missing port (defaults to 80). The helper is internal so a
  JVM unit test can exercise it without Robolectric.

• Non-numeric / out-of-range sharing ports: GlobalSettingsStore stored
  internetSharingSocksPort/HttpPort as String and parsed with
  toIntOrNull() ?: 8090/8091 on load. A corrupted DataStore value
  silently fell back to defaults; an out-of-range integer (e.g. 99999)
  loaded fine and threw IllegalArgumentException only when ServerSocket
  bound at connect time, surfacing as a generic "Go core error".
  Switched both keys to native intPreferencesKey, coerced to 1..65535
  on save. Existing on-device String entries are migrated cleanly by
  renaming the keys to ..._v2 (option a): old String entries are
  simply absent on first load and the 8090/8091 default re-applies —
  no Migration code, one-time settings reset for users who had set a
  non-default port (call out in release notes).

• Malformed ACTION_CONNECT: onStartCommand swallowed profileId <= 0
  with no log, no state update, no stopSelf. The service stayed in
  START_STICKY foreground with a "Connecting..." notification and
  VpnState.CONNECTING forever; the user had to force-stop the app.
  Added an else branch that calls VpnManager.appendLog + setError
  (UI already observes both), stopForeground (API-24-guarded with
  @Suppress("DEPRECATION") fallback), and stopSelf so START_STICKY
  doesn't keep the service alive with no work.

Added 5 JVM unit tests for parseConnectTarget:

• [::1]:443 -> ("::1", 443)
• [::1] -> ("::1", 80)
• 127.0.0.1:8080 -> ("127.0.0.1", 8080)
• example.com -> ("example.com", 80)
• example.com:99999 -> ("example.com", 65535) [coerceIn clamps]

No local build verified (no local Android SDK); CI on push is the
gate (android-ci.yml: debug APK + AAR).

Scope: only 3 files touched — MasterDnsVpnService.kt (+33/-3),
GlobalSettingsStore.kt (+7/-6), new test file (+41).