fix(companion): mesh VPN no longer blocks IPv4 + off-LAN connect via mesh ULA

Field test on 5G (Framework PT): pairing scanned fine but connect
hard-failed on the scanned LAN IP, and enabling the mesh VPN killed the
phone's internet.

- ArchyVpnService: the TUN is IPv6-only, and Android blocks every
  address family the VPN holds no address for — allowFamily(AF_INET)
  (+ allowBypass) so normal traffic flows while only fd00::/8 is routed.
- ServerConnectScreen.connect(): when the LAN address doesn't answer and
  the entry carries a mesh ULA, bring the tunnel up (autoStartIfReady)
  and probe the ULA with retries before reporting failure — the scanned
  IP is a dial hint, the npub/ULA is the identity (npub-first contract).
- Served companion APK refreshed as 0.5.2 (vc22); handoff doc updated.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/HANDOFF-2026-07-23-companion-apk-deploy.md

@@ -18,7 +18,14 @@ user's hands.
   support; web scan modal hands live scanning to it.
 - npub-keyed saved servers (pairing contract item 1, PR #106).
 - Served APK refreshed: `neode-ui/public/packages/archipelago-companion.apk`
-  is now **0.5.1 / versionCode 21** (this commit).
+  is now **0.5.2 / versionCode 22**, which additionally fixes the two field
+  failures from the user's 5G test (screenshots, 21:54):
+  - **Mesh VPN no longer kills the phone's internet** — the IPv6-only TUN
+    never called `allowFamily(AF_INET)`, so Android blocked all IPv4 while
+    the mesh was up. Now allowed (+ `allowBypass`).
+  - **Off-LAN connect works** — `connect()` no longer hard-fails when the
+    scanned LAN IP doesn't answer; it brings the mesh up and probes the
+    node's ULA (`meshIp`) with retries before reporting failure.
 
 ## What to do