DNS 从 fake-ip 切到 redir-host，配合 sniffer 嗅探域名

- enhanced-mode: fake-ip -> redir-host，ping/调试/局域网应用看到真实 IP
- 启用 sniffer 从 TLS SNI/HTTP Host/QUIC 嗅出域名，保证基于域名的分流照常生效
- 新增 proxy-server-nameserver 走代理拉 DoH，防国外域名 DNS 污染
- 新增 nameserver-policy 让国内域名/私有 IP 强制走国内 DNS

via [HAPI](https://hapi.run)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: HAPI <noreply@hapi.run>

clash_base.yaml

@@ -1,20 +1,40 @@
-mixed-port: 7890
-allow-lan: true
-bind-address: '*'
-mode: rule
-log-level: info
-external-controller: '127.0.0.1:9090'
-
-dns:
-  enable: true
-  listen: '127.0.0.1:9053'
-  default-nameserver:
-    - 223.5.5.5
-    - 223.6.6.6
-    - 119.29.29.29
-  enhanced-mode: fake-ip
-  fake-ip-range: 198.18.0.1/16
-  nameserver:
-    - 'https://223.5.5.5/dns-query'
-    - 'https://223.6.6.6/dns-query'
-    - 'https://doh.pub/dns-query'
+mixed-port: 7890
+allow-lan: true
+bind-address: '*'
+mode: rule
+log-level: info
+external-controller: '127.0.0.1:9090'
+
+sniffer:
+  enable: true
+  override-destination: true
+  sniff:
+    HTTP:
+      ports: [80, 8080-8880]
+      override-destination: true
+    TLS:
+      ports: [443, 8443]
+    QUIC:
+      ports: [443, 8443]
+  skip-domain:
+    - 'Mijia Cloud'
+    - '+.push.apple.com'
+
+dns:
+  enable: true
+  listen: '127.0.0.1:9053'
+  ipv6: false
+  enhanced-mode: redir-host
+  default-nameserver:
+    - 223.5.5.5
+    - 119.29.29.29
+  nameserver:
+    - 'https://223.5.5.5/dns-query'
+    - 'https://doh.pub/dns-query'
+  proxy-server-nameserver:
+    - 'https://1.1.1.1/dns-query'
+    - 'https://8.8.8.8/dns-query'
+  nameserver-policy:
+    'geosite:cn,private':
+      - 'https://223.5.5.5/dns-query'
+      - 'https://doh.pub/dns-query'