Build comprehensive privacy suite and hardened browser controls.

Adds VPN-aware leak handling, chain testing UX improvements, hardened Firefox launch/profile management, privacy/device hardening modules, and tray/status upgrades so the app is production-ready as the new baseline.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/test_proxy_god.py

@@ -4,7 +4,7 @@ from __future__ import annotations
 import asyncio
 import unittest
 
-from proxy_chain_manager.service import _is_same_network
+from proxy_chain_manager.leak_detect import is_chain_leak, is_same_subnet
 
 from proxy_chain_manager.config import (
     Settings,
@@ -24,20 +24,34 @@ from proxy_chain_manager.validator import (
 
 class TestSameNetwork(unittest.TestCase):
     def test_exact_match(self) -> None:
-        self.assertTrue(_is_same_network("1.2.3.4", "1.2.3.4"))
+        self.assertTrue(is_same_subnet("1.2.3.4", "1.2.3.4"))
 
     def test_same_slash16(self) -> None:
-        self.assertTrue(_is_same_network("185.220.101.5", "185.220.200.9"))
+        self.assertTrue(is_same_subnet("185.220.101.5", "185.220.200.9"))
 
     def test_different_slash16(self) -> None:
-        self.assertFalse(_is_same_network("185.220.101.5", "104.28.3.99"))
+        self.assertFalse(is_same_subnet("185.220.101.5", "104.28.3.99"))
 
     def test_none_safe(self) -> None:
-        self.assertFalse(_is_same_network(None, "1.2.3.4"))
-        self.assertFalse(_is_same_network("1.2.3.4", None))
+        self.assertFalse(is_same_subnet(None, "1.2.3.4"))
+        self.assertFalse(is_same_subnet("1.2.3.4", None))
 
     def test_non_ipv4_safe(self) -> None:
-        self.assertFalse(_is_same_network("not-an-ip", "1.2.3.4"))
+        self.assertFalse(is_same_subnet("not-an-ip", "1.2.3.4"))
+
+
+class TestLeakDetect(unittest.TestCase):
+    def test_strict_no_vpn_same_ip(self) -> None:
+        self.assertTrue(is_chain_leak("1.2.3.4", "1.2.3.4", vpn_active=False))
+
+    def test_strict_no_vpn_different_ip(self) -> None:
+        self.assertFalse(is_chain_leak("5.6.7.8", "1.2.3.4", vpn_active=False))
+
+    def test_vpn_subnet_leak(self) -> None:
+        self.assertTrue(is_chain_leak("185.220.101.5", "185.220.200.9", vpn_active=True))
+
+    def test_vpn_different_subnet_ok(self) -> None:
+        self.assertFalse(is_chain_leak("104.28.3.99", "185.220.101.5", vpn_active=True))
 
 
 class TestConfig(unittest.TestCase):