fix(route-management): include stored VPN routes in domain resolution and align programmatic route types with dcrouter configs

ts/classes.dcrouter.ts

@@ -2164,6 +2164,26 @@ export class DcRouter {
           }
         }
 
+        // Also scan stored/programmatic routes
+        const storedRoutes = this.routeConfigManager?.getStoredRoutes();
+        if (storedRoutes) {
+          for (const [, stored] of storedRoutes) {
+            if (!stored.enabled) continue;
+            const dcRoute = stored.route as import('../ts_interfaces/data/remoteingress.js').IDcRouterRouteConfig;
+            if (!dcRoute.vpn?.enabled) continue;
+
+            const routeTags = dcRoute.vpn.allowedServerDefinedClientTags;
+            if (!routeTags?.length || clientTags.some(t => routeTags.includes(t))) {
+              const domains = (stored.route.match as any)?.domains;
+              if (Array.isArray(domains)) {
+                for (const d of domains) {
+                  domainsToResolve.add(d.replace(/^\*\./, ''));
+                }
+              }
+            }
+          }
+        }
+
         // Resolve DNS A records for matched domains (with caching)
         for (const domain of domainsToResolve) {
           const resolvedIps = await this.resolveVpnDomainIPs(domain);