Won't connect through private dns

### Describe the Bug

When using android's built in private DNS feature, pangolin will not connect. The connection works with the private DNS turned off, so it's unlikely to be a configuration issue.

### Environment

- OS Type & Version: calyx os 6.10
- Pangolin Version: 1.21.1
- Edition (Community or Enterprise): enterprise
- Gerbil Version: 1.4.3
- Traefik Version: 3.7.10
- Newt Version: 1.15.0
- Client Version: 0.4.1

### To Reproduce

If I set private DNS to none, pangolin connects as expected.
If I set private DNS to cloudflare, pangolin marks itself as connected, but nothing at all is reachable.
If I set private DNS to automatic, pangolin connects as expected.
If I set private DNS to my private DNS (nextdns), pangolin marks itself as connected, but nothing at all is reachable.

### Expected Behavior

I would expect pangolin to work as expected in all of these scenarios, or at least to mark itself as disconnected and display an error message.

Start by reproducing the connection with Android Private DNS set to Cloudflare and NextDNS, comparing it with None and Automatic using the reported Pangolin, Gerbil, Traefik, Newt, and client versions. Trace the Android client’s VPN and DNS handling to determine why it reports connected while traffic is unreachable. Done means traffic works in these modes or the client reports a clear disconnected/error state.

Written by the indexing model from the issue text.