NSAllowsLocalNetworking covers CGNAT 100.64.0.0/10 range used by Tailscale, fixing ATS blocking plain ws:// connections. Also adds NSExceptionDomains entry for 100.64.0.2 as explicit fallback. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>