fix(mobile): propagate SOCKS5 user/pass auth through FakeDNS upstream dial

[Hidden-Node]

What

When FakeDNS is enabled (the default) and the user configures SOCKS5 user/pass
auth on their profile, every TCP connection through the VPN silently fails.

The FakeDNS proxy in fakedns_proxy.go always offered only NO_AUTH when
dialing the inner SOCKS5 server. The inner server's UserPassAuthenticator
rejected the connection, but no error was surfaced — TCP connections just hung.

Why

The FakeDNS dial path had no visibility into the SOCKS5 credentials configured
on StartClient's inner server. The credentials lived in ProfileEntity but
were never threaded through StartTunBridge → StartFakeDNSProxy →
FakeDNSProxy.

Changes

• fakedns_proxy.go: Add SocksUser/SocksPass fields to FakeDNSProxy;
  add dialRealSocks() helper implementing RFC 1928 greeting + RFC 1929
  user/pass sub-negotiation; handleConnection and handleUDPAssociate now
  call it instead of the inline bare 05 01 00 dial.
• tun_api.go: StartFakeDNSProxy signature gains socksUser, socksPass
  params; log line now includes auth=%v.
• mobile.go: StartTunBridge signature gains socksUser, socksPass
  params; passes them to StartFakeDNSProxy. Plan 004's tunOwnedFd block
  preserved unchanged.
• GooseRelayVpnService.kt: Reflective getMethod updated to 5 param
  types; invoke now passes profile.socksUser and profile.socksPass.

Verification

• go vet ./mobile/... — passes on Linux (CI); fails on Windows only due to
  pre-existing syscall.Dup in dupFd (Linux-only syscall).
• gofmt -d on committed blob — clean.
• Select-String done-criteria — all pass (4 files, correct signatures,
  dialRealSocks called from both handlers).
• Scope: only 4 files modified (+111/-32), no out-of-scope changes.
• Runtime: on a device, create a profile with socks_user/socks_pass set,
  keep FakeDNS enabled (default), connect, load a webpage through the VPN.
  Before: silent failure. After: works.

Notes

• No automated tests — runtime verification is manual. A Go-side unit test
  for dialRealSocks against an in-process SOCKS5 server (using
  things-go/go-socks5) is flagged as a follow-up.
• Security: credentials remain in plaintext in the FakeDNS proxy struct for
  the VPN session duration — unchanged from the existing threat model
  (ProfileEntity, Go core config). Not elevated by this PR.