fix: C-01 WebRTC policy value, C-02 scoped taskkill, C-04 preflight race, E-11 socket timeout, E-27 ban test dedup, full audit doc

proxy_chain_manager/ban_tester.py

@@ -145,6 +145,7 @@ def _test_one(
 
 def _dns_resolve_via_system(hostname: str, timeout: float = 5.0) -> str | None:
     """Resolve a hostname using system DNS (does not go through proxy — exposes leak)."""
+    _prev = socket.getdefaulttimeout()
     try:
         socket.setdefaulttimeout(timeout)
         info = socket.getaddrinfo(hostname, None)
@@ -154,6 +155,8 @@ def _dns_resolve_via_system(hostname: str, timeout: float = 5.0) -> str | None:
                 return addr
     except Exception:
         pass
+    finally:
+        socket.setdefaulttimeout(_prev)
     return None
 
 
@@ -235,10 +238,13 @@ def run_ban_tests(
     if sites is not None:
         work = [(s, u, "") for s, u in sites]
     elif categories is not None:
+        seen_urls: set[str] = set()
         work = []
         for cat in categories:
             for s, u in SITE_CATEGORIES.get(cat, ()):
-                work.append((s, u, cat))
+                if u not in seen_urls:
+                    seen_urls.add(u)
+                    work.append((s, u, cat))
     else:
         work = [(s, u, cat) for cat, pairs in SITE_CATEGORIES.items() if cat != "All" for s, u in pairs]