feat(discovery): Windows local-discovery + local route pinning + prompt reconnect

Completes the mDNS local-discovery feature on Windows (was Linux-only since
v2.1.2). Three parts:

1. Windows hosts override (hosts_override_windows.go): %SystemRoot%...\\hosts,
   CRLF-aware read/write, ipconfig /flushdns after each change. The agent runs
   as a SYSTEM service so elevation is a non-issue. hosts_override.go split
   into shared rewrite logic + platform files; the hosts tests now run the real
   Windows write path on CI instead of skipping.

2. Local route pinning (local_route*.go): the hosts override only fixes name
   resolution -- the packet path is the routing table's job. If the WG mesh
   tunnel is up with AllowedIPs covering the LAN (or full-tunnel 0.0.0.0/0) it
   swallows the direct connection. Discovery now pins a /32 host route via the
   owning local interface (route.exe metric 1 on Windows, ip route replace on
   Linux) and drops it on revert. Closes a gap in the shipped Linux path too.

3. Prompt reconnect: apply/revert signals the WS loop so it reconnects
   immediately instead of waiting out the 5s backoff.

Route/hosts code is injectable + unit tested; go test passes natively on
Windows (this machine), and linux/amd64 + windows/arm64 cross-builds are clean.

websocket.go

@@ -241,7 +241,15 @@ func connectWebSocket(cm *ConfigManager, exec Executor) {
 		}
 
 		log.Println("WebSocket disconnected. Reconnecting in 5 seconds...")
-		time.Sleep(5 * time.Second)
+		// A local-discovery apply/revert (hosts override + route change) wants
+		// the new resolution path picked up right away rather than after the
+		// full backoff. discoveryChangedCh is drained here only; a change
+		// while still connected takes effect on the next natural reconnect.
+		select {
+		case <-discoveryChangedCh:
+			log.Println("Local-discovery routing changed; reconnecting immediately.")
+		case <-time.After(5 * time.Second):
+		}
 	}
 }