VPN-aware leak detection, GOST stderr logging

- _is_same_network: /16 subnet comparison catches NordVPN IP rotation
  (exit_ip != real_ip exact-match missed same-VPN exits on rotated IPs)
- Leak now blacklists the entire dead chain, not just rotate
- GOST stderr/stdout -> gost.log (file, never deadlocks vs pipe)
  with 512KB rotation; last 8 lines shown in UI when GOST dies
- read_gost_log_tail helper for live debugging
- Health check uses same subnet check for consistency
- 5 new subnet tests

Made-with: Cursor

tests/test_proxy_god.py

@@ -4,6 +4,8 @@ from __future__ import annotations
 import asyncio
 import unittest
 
+from proxy_chain_manager.service import _is_same_network
+
 from proxy_chain_manager.config import (
     Settings,
     merge_proxy_credentials,
@@ -20,6 +22,24 @@ from proxy_chain_manager.validator import (
 )
 
 
+class TestSameNetwork(unittest.TestCase):
+    def test_exact_match(self) -> None:
+        self.assertTrue(_is_same_network("1.2.3.4", "1.2.3.4"))
+
+    def test_same_slash16(self) -> None:
+        self.assertTrue(_is_same_network("185.220.101.5", "185.220.200.9"))
+
+    def test_different_slash16(self) -> None:
+        self.assertFalse(_is_same_network("185.220.101.5", "104.28.3.99"))
+
+    def test_none_safe(self) -> None:
+        self.assertFalse(_is_same_network(None, "1.2.3.4"))
+        self.assertFalse(_is_same_network("1.2.3.4", None))
+
+    def test_non_ipv4_safe(self) -> None:
+        self.assertFalse(_is_same_network("not-an-ip", "1.2.3.4"))
+
+
 class TestConfig(unittest.TestCase):
     def test_normalize_proxy_url(self) -> None:
         self.assertEqual(normalize_proxy_url(""), "")