Add proxy subscription runtime support

Add daemon RPCs, Apple and GTK import flows, packet proxy runtime support, diagnostics, and BEPs for proxy subscription handling.

Redact subscription URL secrets from fetch errors before they reach logs or UI surfaces.

Apple/UI/NetworkExtensionTunnel.swift

@@ -98,23 +98,33 @@ public final class NetworkExtensionTunnel: Tunnel {
             }
         }
 
-        guard managers.isEmpty else { return }
-
-        let manager = NETunnelProviderManager()
-        manager.localizedDescription = "Burrow"
+        let manager = managers.first ?? NETunnelProviderManager()
+        var needsSave = managers.isEmpty
+        if manager.localizedDescription != "Burrow" {
+            manager.localizedDescription = "Burrow"
+            needsSave = true
+        }
 
         let proto = NETunnelProviderProtocol()
         proto.providerBundleIdentifier = bundleIdentifier
         proto.serverAddress = "burrow.rs"
+        proto.proxySettings = nil
 
-        manager.protocolConfiguration = proto
-        try await manager.save()
+        if !manager.protocolConfiguration.isBurrowEquivalent(to: proto) {
+            manager.protocolConfiguration = proto
+            needsSave = true
+        }
+
+        if needsSave {
+            try await manager.save()
+        }
     }
 
     public func start() {
         Task {
-            guard let manager = try await NETunnelProviderManager.managers.first else { return }
             do {
+                try await configure()
+                guard let manager = try await NETunnelProviderManager.managers.first else { return }
                 if !manager.isEnabled {
                     manager.isEnabled = true
                     try await manager.save()
@@ -149,6 +159,17 @@ public final class NetworkExtensionTunnel: Tunnel {
     }
 }
 
+private extension Optional where Wrapped == NEVPNProtocol {
+    func isBurrowEquivalent(to expected: NETunnelProviderProtocol) -> Bool {
+        guard let current = self as? NETunnelProviderProtocol else {
+            return false
+        }
+        return current.providerBundleIdentifier == expected.providerBundleIdentifier
+            && current.serverAddress == expected.serverAddress
+            && current.proxySettings == nil
+    }
+}
+
 extension NEVPNConnection {
     fileprivate var tunnelStatus: TunnelStatus {
         switch status {