fix: sanitize Discord community subnets and resolve WAN monitor hotplug spam (fixes #50, #51)

- Fix #50: Discord community subnets hijacking Cloudflare Anycast traffic:
  * Filter broad Cloudflare shared subnets (104.16.0.0/12, 172.64.0.0/13, etc.) for Discord preset in generator_routes.uc, nft/apply.uc, and updates.uc.
  * Add tachyon resolve_domain CLI and runtime.uc helper for DNS queries with rpcd ACL support.
  * Update LuCI Routing Rule Tracer to resolve queried domains against section subnets/CIDRs (including community subnets) and show shared CDN/Anycast warnings.
  * Add unit tests in tests/community_subnets_sanitization.sh.

- Fix #51: Telegram bot spamming WAN up/down notifications on hotplug:
  * Check enable_badwan_interface_monitoring, telegram.enabled, and badwan_monitored_interfaces list in 99-tachyon-wan-monitor.
  * Add background debounce with atomic directory locking and ubus interface status verification.
  * Implement state transition tracking to only notify on actual UP->DOWN and DOWN->UP changes without duplicates.
  * Preserve retry_start_on_wan_up behavior on ifup.
  * Add comprehensive integration test suite in tests/wan_monitor_hotplug.sh.

tachyon/files/usr/lib/core/ip.uc

@@ -254,6 +254,24 @@ function normalize_to_cidrs(items) {
     return result;
 }
 
+const CLOUDFLARE_SHARED_CIDRS = [
+    "104.16.0.0/12", "104.24.0.0/14", "172.64.0.0/13", "162.158.0.0/15",
+    "108.162.192.0/18", "190.93.240.0/20", "188.114.96.0/20", "197.234.240.0/22",
+    "198.41.128.0/17", "162.159.0.0/16", "173.245.48.0/20", "103.21.244.0/22",
+    "103.22.200.0/22", "103.31.4.0/22", "141.101.64.0/18",
+    "2606:4700::/32", "2400:cb00::/32", "2405:b500::/32", "2803:f800::/32",
+    "2a06:98c0::/29", "2c0f:f248::/32"
+];
+
+function is_cloudflare_shared_cidr(value) {
+    value = trim(as_string(value));
+    for (let c in CLOUDFLARE_SHARED_CIDRS) {
+        if (value == c)
+            return true;
+    }
+    return false;
+}
+
 return {
     valid_ipv4,
     valid_ipv4_cidr,
@@ -268,5 +286,8 @@ return {
     format_ipv6_tproxy_target,
     ipv6_supported,
     resolve_mac_to_ips,
-    normalize_to_cidrs
+    normalize_to_cidrs,
+    CLOUDFLARE_SHARED_CIDRS,
+    is_cloudflare_shared_cidr
 };
+