fix: Handle dnsmasq local=/ directive in DNS filter parser

The parser only recognized address=/ and server=/ prefixes but not
local=/, which is the format used by Hagezi blocklists. This caused
~270k domains to be stored with the raw "local=/domain/" string as
the domain name, breaking allow-list matching.

internal/dnsfilter/parser.go

@@ -16,8 +16,8 @@ func ParseLine(line string) (string, bool) {
 		return "", false
 	}
 
-	// dnsmasq format: address=/domain/0.0.0.0 or server=/domain/
-	if strings.HasPrefix(line, "address=/") || strings.HasPrefix(line, "server=/") {
+	// dnsmasq format: address=/domain/... or server=/domain/ or local=/domain/
+	if strings.HasPrefix(line, "address=/") || strings.HasPrefix(line, "server=/") || strings.HasPrefix(line, "local=/") {
 		parts := strings.SplitN(line, "/", 4)
 		if len(parts) >= 3 && parts[1] != "" {
 			return validateDomain(parts[1])

internal/dnsfilter/parser_test.go

@@ -39,6 +39,7 @@ func TestParseLine_DnsmasqFormat(t *testing.T) {
 		{"address=/ads.example.com/0.0.0.0", "ads.example.com", true},
 		{"address=/tracker.example.com/", "tracker.example.com", true},
 		{"server=/blocked.example.com/", "blocked.example.com", true},
+		{"local=/blocked.example.com/", "blocked.example.com", true},
 		{"address=//", "", false},
 	}