fix: sanitize Discord community subnets and resolve WAN monitor hotplug spam (fixes #50, #51)

- Fix #50: Discord community subnets hijacking Cloudflare Anycast traffic:
  * Filter broad Cloudflare shared subnets (104.16.0.0/12, 172.64.0.0/13, etc.) for Discord preset in generator_routes.uc, nft/apply.uc, and updates.uc.
  * Add tachyon resolve_domain CLI and runtime.uc helper for DNS queries with rpcd ACL support.
  * Update LuCI Routing Rule Tracer to resolve queried domains against section subnets/CIDRs (including community subnets) and show shared CDN/Anycast warnings.
  * Add unit tests in tests/community_subnets_sanitization.sh.

- Fix #51: Telegram bot spamming WAN up/down notifications on hotplug:
  * Check enable_badwan_interface_monitoring, telegram.enabled, and badwan_monitored_interfaces list in 99-tachyon-wan-monitor.
  * Add background debounce with atomic directory locking and ubus interface status verification.
  * Implement state transition tracking to only notify on actual UP->DOWN and DOWN->UP changes without duplicates.
  * Preserve retry_start_on_wan_up behavior on ifup.
  * Add comprehensive integration test suite in tests/wan_monitor_hotplug.sh.

tachyon/files/usr/lib/singbox/generator_routes.uc

@@ -1456,8 +1456,11 @@ function load_community_subnet_cidrs(community) {
             let cidrs = [];
             for (let line in split(as_string(content), "\n")) {
                 line = trim(replace(as_string(line), /\r/g, ""));
-                if (line != "" && substr(line, 0, 1) != "#" && match(line, /^[0-9a-fA-F:.]+(\/[0-9]+)?$/) && !match(line, /\.$/))
+                if (line != "" && substr(line, 0, 1) != "#" && match(line, /^[0-9a-fA-F:.]+(\/[0-9]+)?$/) && !match(line, /\.$/)) {
+                    if (service == "discord" && core_ip.is_cloudflare_shared_cidr(line))
+                        continue;
                     push(cidrs, line);
+                }
             }
             if (length(cidrs) > 0)
                 return cidrs;
@@ -2023,5 +2026,6 @@ return {
     add_server_routes,
     outbound_supports_udp,
     push_section_route_rule,
-    is_valid_detour
+    is_valid_detour,
+    load_community_subnet_cidrs
 };