feat(fronting-groups): bundle curated edges + UI loaders

[dazzling-no-more]

Summary

Ships a curated fronting_groups bundle derived from
patterniha/MITM-DomainFronting,
plus one-click loaders on the desktop and Android UIs. Coverage:

• vercel (react.dev SNI, 29 domains incl. vercel.*, nextjs.org, cursor.com, zeit.*)
• fastly (pypi.org SNI, 40 domains incl. reddit, cnn, pinterest, buzzfeed, python, github-content)
• cloudfront (kubernetes.io SNI, netlify)
• github-direct (github.com SNI for gist.github.com)
• github-content-direct (central.github.com SNI for objects-origin.githubusercontent.com)

Single source of truth: assets/fronting-groups/curated.json. The desktop binary
embeds it via include_str!; the Android APK pulls it through a Gradle Copy task
into build/generated/curatedAssets/ (wired via sourceSets.main.assets.srcDir,
so a gradlew clean wipes stale copies — no .gitignore carve-out under src/).
The example file config.fronting-groups.example.json mirrors the same payload
for CLI users; a test pins the two against drift.

The merge semantics are deliberately conservative: groups whose name already
exists in the user's config are skipped (case-insensitive, trimmed). Hand-edited
entries are never overwritten.

Drive-by: Android silent-drop fix

ConfigStore.kt
didn't model fronting_groups at all — the Kotlin Save path silently dropped
the field on round-trip, wiping any hand-edited or imported groups when the
user hit Save. Added a FrontingGroup data class, the frontingGroups field
on MhrvConfig, and round-trip in toJson() / loadFromJson() / encode().

Test plan

• cargo test --lib curated_groups — 5/5 (parse, merge × 2, validate-curated-via-Config::load, example-mirrors-curated)
• gradlew :app:testDebugUnitTest — 8/8 (round-trip, empty-omitted, malformed-skipped, unknown-keys-ignored, empty-existing, name-collision, case-insensitive-with-trim, merge-is-pure)
• gradlew :app:compileDebugKotlin clean
• gradlew :app:clean :app:mergeDebugAssets — confirms generated asset reaches APK at fronting-groups/curated.json (matches CuratedGroups.ASSET_PATH)
• cargo check --features ui clean (lib + both binaries)

Notes for reviewers

• Edge IPs in the curated bundle were picked from anycast / known-stable values; they may need refresh by re-resolving each group's sni. Documented in docs/fronting-groups.md and inline in curated.json's _comment.
• config.fronting-groups.example.json and assets/fronting-groups/curated.json carry duplicate payloads by design — the example is for CLI users, the asset is for the embedded loader. The example_file_mirrors_curated_bundle Rust test enforces they stay identical.
• Encode/decode (Base64 + DEFLATE) coverage is omitted from the Android tests because android.util.Base64 is stubbed in JVM unit tests; the JSON payload it wraps is the same code path the round-trip test covers.