Build comprehensive privacy suite and hardened browser controls.

Adds VPN-aware leak handling, chain testing UX improvements, hardened Firefox launch/profile management, privacy/device hardening modules, and tray/status upgrades so the app is production-ready as the new baseline.

Co-authored-by: Cursor <cursoragent@cursor.com>

proxy_chain_manager/config.py

@@ -115,7 +115,7 @@ class Settings:
     # ── chain ─────────────────────────────────────────────────────────────
     chain_length: int = 3                # number of hops (2-8)
     obfuscation_mode: str = "auto"       # see OBFUSCATION_MODES
-    use_pinned_chain: bool = False        # use manually ordered chain
+    use_pinned_chain: bool = True         # use manually ordered chain from Chain Builder
     pinned_chain: list[str] = field(default_factory=list)  # user-ordered hop list
     # Fixed last hop only (ignored when use_pinned_chain is True — full manual chain wins)
     manual_exit_proxy: str = ""
@@ -135,6 +135,29 @@ class Settings:
     kill_switch_enabled: bool = True     # engage Windows Firewall kill-switch when running
     proxy_bypass: str = "localhost;127.*;10.*;192.168.*;<local>"
 
+    # ── privacy / device hardening (Privacy tab) ───────────────────────────
+    mac_spoof_enabled: bool = False          # randomize NIC MAC while chain runs (Admin)
+    spoof_hostname_enabled: bool = False     # temporary computer name while chain runs (Admin)
+    flush_dns_on_rotate: bool = True         # ipconfig /flushdns on each rotation
+    disable_ipv6_while_active: bool = False  # disable IPv6 bindings while chain runs (Admin)
+    harden_webrtc_enabled: bool = False      # Chrome/Edge WebRTC policy (Admin)
+
+    # ── hardened browser ────────────────────────────────────────────────────
+    firefox_path: str = ""
+    firefox_profile_dir: str = ""
+    browser_clear_on_close: bool = True
+    browser_disposable_profile: bool = False
+    browser_kill_on_chain_drop: bool = True
+    browser_auto_relaunch: bool = False
+    browser_lock_managed_profile: bool = True
+    browser_force_proxy: bool = True
+    browser_disable_webrtc: bool = True
+    browser_resist_fingerprinting: bool = True
+    browser_disable_telemetry: bool = True
+    browser_first_party_isolation: bool = True
+    browser_strict_tracking_protection: bool = True
+    browser_timezone_utc: bool = True
+
     # ── sources ───────────────────────────────────────────────────────────
     sources: list[str] = field(
         default_factory=lambda: [