feat(client): warn on TAP default routes

PLAN.md calls for a user-facing warning when TAP routing could steal the
relay path. The client already disables TAP default routes under a scoped guard,
but the startup output only reported the previous raw flag value.

Format the route-protection message as a warning whenever default routes were
enabled before the scoped override. Keep the already-disabled case quiet and
explicit, and cover both messages with tests that run on non-Windows builds.

Document the startup warning alongside the existing route-protection behavior.

Test Plan:
- cargo fmt --check
- cargo test -p lanparty-client-win -p lanparty-client-route
- cargo test --workspace
- cargo clippy --workspace --all-targets -- -D warnings
- git diff --check

Refs: PLAN.md

README.md

@@ -197,10 +197,11 @@ TAP media connected, and reports the driver MAC/MTU before forwarding frames,
 along with the TAP interface index/LUID. The client applies a scoped TAP
 interface metric and disables TAP default routes while it runs, periodically
 rechecks that the relay route remains pinned, then restores the previous route
-policy on exit. Startup still fails before bridging if the driver-reported MAC
-does not match the tunnel identity, because an already-initialized Windows TAP
-adapter may need to be disabled/enabled or reinstalled before it reloads the
-configured `NetworkAddress`.
+policy on exit. Startup prints a warning when TAP default routes were enabled
+before the scoped protection was applied. Startup still fails before bridging
+if the driver-reported MAC does not match the tunnel identity, because an
+already-initialized Windows TAP adapter may need to be disabled/enabled or
+reinstalled before it reloads the configured `NetworkAddress`.
 It prints and reports client diagnostics snapshots with relay reachability,
 LAN-gateway presence, route-pinning, QUIC datagram budget, TAP status/IP,
 broadcast frame flow, frame/datagram counters, and drops. The periodic