* Add profile authentication method - Persistent (default, fallback) - Interactive (may expire through reconnections) - TOTP (seed-based) - currently disabled * Disable on-demand if login is interactive * Present interactive prompt on VPN toggle
* Drop VPNManager dependency on TunnelKit * Hook .masksPrivateData to preferences updates