TUN inbound: Error out when autoSystemWfpBlockLeak or autoSystemDnsToGateway cannot apply

As asked in review, rather than run without them:

- The config is rejected, also by xray -test, for autoSystemWfpBlockLeak
  without autoSystemRoutingTable, or with "dns" but without dns, on
  Windows, and for autoSystemDnsToGateway without gateway on Linux.
- Xray does not start when the filters cannot be added, now on every
  Windows version, or when the system DNS cannot be set on Linux,
  instead of logging it and running without them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

proxy/tun/handler.go

@@ -166,12 +166,14 @@ func (t *Handler) Start() error {
 	}
 
 	// Platform-specific system DNS takeover, where the platform implements it.
-	// Non-fatal: a failure leaves DNS management with the OS.
+	// Rather no TUN than one that the system DNS bypasses.
 	if c, ok := tunInterface.(interface {
 		ConfigureSystemDNS(context.Context, string) error
 	}); ok {
 		if err := c.ConfigureSystemDNS(t.ctx, t.tag); err != nil {
-			errors.LogInfoInner(t.ctx, err, "[tun] system DNS not configured")
+			_ = tunStack.Close()
+			_ = tunInterface.Close()
+			return errors.New("unable to set the system DNS (remove autoSystemDnsToGateway to run without)").Base(err)
 		}
 	}