fix(android): auto-fallback local dns port to 5353 for non-root devices and add UI warning

Author: RamtinAbdi

android/app/src/main/java/com/masterdns/vpn/service/MasterDnsVpnService.kt

@@ -133,13 +133,27 @@ class MasterDnsVpnService : VpnService() {
                     }
                 }
 
+                // Detect LOCAL_DNS_ENABLED with a privileged port (<=1024) — requires root on Android.
+                // Automatically fall back to port 5353 to avoid a bind permission error on non-rooted devices.
+                val advancedForDns = parseAdvanced(runtimeProfile.advancedJson)
+                val localDnsEnabled = advancedForDns["LOCAL_DNS_ENABLED"].equals("true", ignoreCase = true)
+                val localDnsPort = advancedForDns["LOCAL_DNS_PORT"]?.toIntOrNull() ?: 53
+                val safeDnsPort: Int? = if (!proxyMode && localDnsEnabled && localDnsPort <= 1024) {
+                    VpnManager.appendLog(
+                        "WARNING: LOCAL_DNS_PORT=$localDnsPort requires root on Android. " +
+                            "Automatically using port 5353 instead."
+                    )
+                    5353
+                } else null
+
                 configFile.writeText(
                     ConfigGenerator.generateConfig(
                         profile = runtimeProfile,
                         listenPort = socksPort,
                         listenIpOverride = listenIpOverride,
                         protocolOverride = protocolOverride,
-                        localDnsEnabledOverride = if (proxyMode) false else null
+                        localDnsEnabledOverride = if (proxyMode) false else null,
+                        localDnsPortOverride = if (proxyMode) null else safeDnsPort
                     )
                 )
                 if (runtimeProfile.resolvers.isNotBlank()) {

android/app/src/main/java/com/masterdns/vpn/ui/settings/SettingsScreen.kt

@@ -399,6 +399,31 @@ fun SettingsScreen(
                 if (!expanded) return@items
 
                 Spacer(modifier = Modifier.height(6.dp))
+                if (section == "DNS") {
+                    val dnsEnabled = fieldsState["LOCAL_DNS_ENABLED"].equals("true", ignoreCase = true)
+                    val dnsPort = fieldsState["LOCAL_DNS_PORT"]?.toIntOrNull() ?: 53
+                    if (dnsEnabled && dnsPort <= 1024) {
+                        Card(
+                            colors = CardDefaults.cardColors(
+                                containerColor = MaterialTheme.colorScheme.errorContainer
+                            ),
+                            modifier = Modifier.fillMaxWidth()
+                        ) {
+                            Row(
+                                modifier = Modifier.padding(12.dp),
+                                verticalAlignment = Alignment.CenterVertically
+                            ) {
+                                Text(
+                                    text = "⚠ Port $dnsPort requires root access on Android. " +
+                                        "The app will automatically use port 5353 instead.",
+                                    style = MaterialTheme.typography.bodySmall,
+                                    color = MaterialTheme.colorScheme.onErrorContainer
+                                )
+                            }
+                        }
+                        Spacer(modifier = Modifier.height(8.dp))
+                    }
+                }
                 sections[section].orEmpty().forEach { field ->
                     if ((field.key == "SOCKS5_USER" || field.key == "SOCKS5_PASS") && !socksAuthEnabled) {
                         return@forEach