Bump meow-rs kernel to 0.21.1, enable sing-mux, and move to meow-rs/meow-rs

[madeye]

Moves the pinned kernel rev from 7d7f830 (0.20.2) to bc38424 (0.21.1) — 86 upstream commits — and repoints every reference at the kernel's new home, github.com/meow-rs/meow-rs.

Notable upstream fixes that reach this app

• anytls — auth record is written in a single TLS record, fixing servers that reject a split auth flight
• dns — fake-IP lookup is serialised across the store read and the allocation, closing a double-allocation race that could silently drop a host's live forward mapping; del_by_ip is now compare-and-delete
• udp — NAT key claimed atomically, eviction gated on session identity
• config — rule/proxy-provider paths contained inside the cache dir; direct HTTP fetches for rule-providers and geodata cap the body size
• reality — pre-auth server-flight transcript capped and ordered; unquoted numeric short-id accepted (mihomo compat)
• vless — the XTLS Vision + mux gate narrowed to sing-mux, so Mux.Cool is allowed again

Feature change

mux is added to the meow-config feature list. sing-mux landed upstream and is part of meow-app's full protocol set, which this crate mirrors; nodes carrying smux: now multiplex instead of being rejected.

Repo move

The kernel repo moved from madeye/meow-rs to meow-rs/meow-rs. The seven git dependencies, the lockfile, and the prose links in README.md and docs/index.html now use the new URL. The pinned rev is unchanged — bc38424 is HEAD of the new remote and resolves identically there. GitHub still redirects the old path, but pinning the canonical URL keeps cargo update and fresh clones off that redirect.

Verification

• cargo fmt --check, cargo clippy --all-targets -- -D warnings — clean
• From-scratch fetch and release build of the FFI crate against the new remote — succeeds
• make framework — arm64 + x86_64, universal lipo OK
• Debug and Release app builds — succeed
• swiftlint lint --strict — 0 violations
• BaoLianDengTests — 212/213 pass

The one failure, HTTP request through SOCKS5 proxy, is environmental and not a regression. It curls --socks5 (curl resolves the hostname locally, so the engine receives an IP literal) to gstatic, and the network this ran on cannot reach that Google IP directly at all — plain curl --resolve with no proxy in the path times out identically. Running the same minimal config against a meow binary built at the previous 0.20.2 rev reproduces the failure byte-for-byte, while --socks5-hostname and the HTTP-proxy path succeed on both revs.