sboxrun: domain+IP-CIDR rules + remove voice-quality test

Three follow-up fixes after the WinDivert→sing-box pivot:

1. Discord updater now routes through upstream. Previously only the
   process-name rule matched, but sing-box's TUN-side process
   detection on Windows mis-attributes the in-process Rust updater's
   TLS connection to e.g. steam.exe — the connection went direct and
   hit RKN block. Adding domain_suffix + ip_cidr rules for Cloudflare
   (162.159/16, 104.16/13, 172.64/13) and Fastly (199.232/16,
   151.101/16) catches updates.discord.com regardless of which PID
   the kernel claims sent it. Verified via curl through mihomo:
   updates.discord.com responds 400 in 393ms (i.e. TLS handshake
   succeeds, only the path is wrong — proves the routing reaches it).

2. DiscordSystemHelper.exe added to TargetProcs alongside Update.exe
   (modern Discord builds use it for elevated updates).

3. UDP voice quality test removed from the checker. The STUN-via-
   relay burst measured private mihomo BND.ADDR (192.168.1.132)
   which is unroutable from external clients, so the test reported
   100% loss every time despite voice actually working through
   sing-box's TUN+SOCKS5. The remaining 6 checks (TCP/greet/auth/
   connect/UDP/api) cover what's actionable; voice quality is
   verified empirically by joining a Discord call.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/sboxrun/config.go

@@ -85,7 +85,47 @@ func BuildSingBoxConfig(c Config) (string, error) {
 			"auto_detect_interface": true,
 			"final":                 "direct",
 			"rules": []any{
-				// Route only the target processes via upstream
+				// 1. Domain rule for sniffed SNI (works when sniffing
+				// catches the ClientHello before route decision).
+				map[string]any{
+					"domain_suffix": []string{
+						"discord.com",
+						"discord.gg",
+						"discord.media",
+						"discordapp.com",
+						"discordapp.net",
+						"discord.dev",
+					},
+					"outbound": "upstream",
+				},
+				// 2. IP-CIDR fallback — sing-box on Windows TUN
+				// sometimes misattributes the source process for
+				// Discord's in-process Rust updater (gets attributed
+				// to steam.exe or similar), so even with the right
+				// process_name list the updater's TLS connection to
+				// updates.discord.com (Fastly: 199.232.x.x) goes
+				// direct and gets RKN-blocked. Force the major
+				// Discord/Cloudflare/Fastly ranges through upstream
+				// regardless of which process the kernel claims sent
+				// them.
+				map[string]any{
+					"ip_cidr": []string{
+						// Fastly (updates.discord.com)
+						"151.101.0.0/16",
+						"199.232.0.0/16",
+						"185.199.108.0/22",
+						// Cloudflare (Discord gateway, CDN, media)
+						"162.158.0.0/15",
+						"162.159.0.0/16",
+						"104.16.0.0/13",
+						"104.24.0.0/14",
+						"172.64.0.0/13",
+						"131.0.72.0/22",
+					},
+					"outbound": "upstream",
+				},
+				// 3. Process-name rule — covers Discord traffic to
+				// non-Cloudflare destinations (RTC voice, etc).
 				map[string]any{
 					"process_name": c.TargetProcs,
 					"outbound":     "upstream",