[andre487]

Adds MASQUE α profiles for authenticated TCP CONNECT and CONNECT-UDP through GOST over a shared HTTP/3 session. Android retains DoH/fallback, per-app routing, local bypass, IPv4/IPv6 policy, encrypted configuration, traffic accounting and failover. HTTPS and MASQUE keep separate custom TLS/QUIC JA3 values across persistence and import/export; vendored v8 schemas pin the exact commit from andre487/MegaProxyConfig#3.

Streams share a QUIC session with GOAWAY rollover, cancellation/deadline handling and TCP half-close. Oversized UDP packets are dropped whole without breaking subsequent traffic. Individual target failures and caller deadlines do not trigger proxy-wide DPI recovery. Logs contain bounded, sanitized events with local session/stream IDs and numeric QUIC errors.

The UI labels HTTP/3 multiplexing and shows passive QUIC RTT and outgoing packet-loss declarations over five minutes. Connection diagnostics independently check inner HTTP/3 through CONNECT-UDP against Cloudflare and BrowserLeaks, with verified destination certificates and no TCP fallback. These native diagnostic probes verify the proxy UDP path, not Android TUN/per-app routing. Explicit unsupported imported transports fail instead of being converted to HTTPS; omitted legacy types retain the HTTPS default.

GOST 3.3.0 needs masque+http3 with datagrams enabled. uQUIC Chrome 146 / Firefox 116 presets approximate TLS/QUIC handshakes; HTTP/3 settings use library defaults. Firefox’s datagram budget cannot carry a 1200-byte inner QUIC Initial. GOST rejects IPv6-literal CONNECT-UDP targets and lacks reliable oversized-packet capsule fallback. These alpha limits remain documented. The pinned uQUIC source closure includes documented compatibility/lifecycle changes for existing uTLS 1.8.2.

Validation:

• Local Fastlane native tests: 104 passing with race detector; real nested QUIC/MASQUE, GOAWAY, deadlines, half-close, certificate rejection, authentication and UDP boundaries.
• Local Fastlane Android checks: 207 JVM tests, lint, debug APK and verified unsigned release APK pass; instrumentation build passed after the networking fixes.
• Manual API 35 connection test: Cloudflare and BrowserLeaks both confirmed inner HTTP/3 through GOST; profiles preserved during upgrades.
• Final Android CI passed on 8a632561: JVM/lint/debug/unsigned release checks and both real emulator suites. API 26: 18/18, including custom MASQUE → HTTPS failover in 67 seconds; API 35: 19/19. Final CI. Native race/real GOST/OpenSSH and Python checks passed on the unchanged native/Python ancestor CI; selective CI correctly reused these suites.

APK artifacts

• Download debug APK — signed with the disposable Android debug key
• Download unsigned release APK — verified unsigned

Built from commit 8a632561 by CI run #256.
Artifacts expire after 14 days. Neither APK uses the MegaProxy release key.