Add optional hotspot downstream forwarding via ZeroTier (without coupling to network auto-rebuild policy)

[Copilot]

• Review current hotspot forwarding and smart-routing integration
• Verify baseline validation status before changes
• Acknowledge and incorporate the fallback requirement to send all hotspot traffic into VPN when needed
• Make hotspot setting changes trigger immediate force-reconfigure of the active VPN
• Strengthen hotspot downstream interface/subnet detection and add observable runtime logs
• Add evidence logging when hotspot downstream traffic actually enters TUN
• Keep hotspot traffic on the existing smart-routing path, with fallback behavior sending all hotspot traffic into VPN
• Update related settings text to describe best-effort hotspot routing accurately
• Add or update focused tests for route-splitting / hotspot routing helpers
• Re-run validation and summarize results