android: Pin direct-flow sockets to the active network (2.13.10)

Diag/charon logs from 2026-09-30 16:45 showed that after a Wi-Fi->cellular
roam every direct-TCP connect failed asynchronously with EHOSTUNREACH for
minutes, while the IKE socket worked and a Java socket explicitly bound to
the underlying network connected fine: a bare VpnService.protect() left
fresh sockets routed over the vanished network.

- CharonVpnService.protectDirect(fd): protect + Network.bindSocket to the
  active non-VPN network (API 23+, best-effort, adoptFd/detachFd)
- charonservice_protect_direct_socket() JNI wrapper; relay and UDP flow
  sockets use it at creation
- direct_tcp: one retry on a fresh socket when an async connect fails;
  reprotect aborts still-connecting relays (RST) instead of letting the
  kernel take ~90s to report the dead route; failures log dst=ip:port
- direct_udp: reprotect closes all flows; they re-open per packet with a
  fresh, network-pinned socket
- TUN reader: EBADF after a reauth re-establish is no longer logged

Published as 2.13.10 (versionCode 147).

src/frontends/android/app/build.gradle

@@ -37,8 +37,8 @@ android {
         minSdkVersion 21
         targetSdkVersion 36
 
-        versionCode 146
-        versionName "2.13.9"
+        versionCode 147
+        versionName "2.13.10"
 
         /* Base URL of the update storage, trailing slash included */
         buildConfigField "String", "UPDATE_BASE_URL", "\"${updateBaseUrl}\""