fix(android): inline VpnTileService IO/Main dispatcher switch and guard on isActive

[Hidden-Node]

Plan 009 — Fix VpnTileService IO/Main dispatcher bug + null guard

Replaces the nested launch(Dispatchers.Main) inside the IO coroutine with a single tileScope.launch using withContext(Dispatchers.IO) for the Room read, plus an isActive guard after the DB read returns.

What changed

• VpnTileService.kt: Rewrote connectFromTileIfReady — the nested launch(Dispatchers.Main) is gone; the outer launch runs on the scope's default Main dispatcher, with an explicit withContext(Dispatchers.IO) hop for the database call and an isActive check before calling VpnManager.connect or openApp.
• VpnTileService.kt: Extracted TileAction enum and tileActionForSelectedProfile() as a testable pure function.
• VpnTileServiceConnectLogicTest.kt: New unit test — 2 cases pinning both branches of the decision logic.

Why

The original structure had two issues:

1. The inner launch(Dispatchers.Main) could complete after onDestroy cancelled the parent scope (cancel is non-preemptive for non-suspending calls like VpnManager.connect).
2. The nested-launch structure was confusing and harder to review.

Verification

• No launch(Dispatchers.Main) remaining in VpnTileService.kt
• withContext(Dispatchers.IO) + isActive guard present
• Test file has 2 @test methods following JUnit4+Truth pattern
• Gradle: CI will run compileDebugKotlin, testDebugUnitTest, assembleDebug on push

Scope

Only VpnTileService.kt and the new test file are modified. No changes to manifest, VpnManager.kt, or updateTile().