Generalize Tun source-IP detection in doctor log evidence: parse the
TUN adapter CIDR from logs and match traffic against it, while keeping
built-in default Tun ranges (28.x, 198.18.x, 198.19.x). Add offline
check script covering the new detection cases.
Arvin