VPN-compatible system-wide blocking

A new engine that keeps device-wide DNS protection active while a VPN is connected - removing today's honest limitation where the system-wide layer pauses on a Mac while a VPN owns DNS. Browser extensions already work under any VPN; this brings the whole device along.