Extracted the WSS toggle from the UoT stealth block to make it
accessible regardless of transport mode. Added a dedicated XTLS-Reality
toggle to avoid relying on empty/non-empty PBK strings to determine
the enabled state, allowing users to toggle Reality without wiping keys.
When using xhttp (UoT) mode on Android, the underlying TcpStream was
not protected with VpnService.protect(fd). This caused the TCP connection
to be routed back into the TUN interface, creating an infinite routing
loop and failing the connection immediately.
Added Android-specific socket protection to the TcpStream in connect_xhttp.
This fixes xhttp/UoT mode on mobile networks.
ospab