Add Wi-Fi and domain exclusions to DNS profiles

[frousselet]

Adds two configurable exclusion lists to generated DNS profiles, giving users control over where encrypted DNS is bypassed:

• Wi-Fi exclusions: list trusted Wi-Fi networks (SSIDs) where encrypted DNS should not apply. On a matching network the device falls back to the network's default resolver. Implemented as an OnDemandRules entry with Action: Disconnect, InterfaceTypeMatch: WiFi and an SSIDMatch array.
• Domain exclusions: the list of domains that bypass encrypted DNS is now editable in the UI instead of being hard-coded. The previous hard-coded list (Apple captive-portal detection + carrier voicemail) is kept as the default.

[fransallen]

Good addition! It would be better if the "Excluded Domains" form could be collapsed/expanded via a toggle button to avoid cluttering the default view. Please iterate on this; I’ll merge once the UI is clean and polished.