DPI bypass using eBPF sock_ops and fake TLS ClientHello injection

Uses BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB to detect new TLS connections, then injects a fake ClientHello with spoofed SNI and low TTL via raw socket before the real handshake. Includes MSS clamping for ClientHello fragmentation and a built-in DoH resolver. Comments