add DHCP lease renewal at T/2

- Add Renew() to dhcp.Client: sends REQUEST with ciaddr (RENEWING state)
- Start renewal goroutine in session at lease_time/2
- On IP change: flush TAP, reconfigure address/routes/DNS/policy routes
- On renewal failure: retry at T/4 (min 60s)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

pkg/netcfg/netcfg.go

@@ -80,6 +80,17 @@ func ConfigureTAP(ifname string, lease *dhcp.Lease, acceptDefaultGW, acceptStati
 	return cleanup, nil
 }
 
+// ReconfigureTAP flushes the current TAP config and applies a new lease.
+// Used when DHCP renewal returns a different IP address.
+func ReconfigureTAP(ifname string, lease *dhcp.Lease, acceptDefaultGW, acceptStaticRoutes, acceptDNS bool) {
+	log.Printf("tap %s: reconfiguring for new IP", ifname)
+	run("ip", "addr", "flush", "dev", ifname)
+	// Ignore errors — best effort reconfiguration
+	if _, err := ConfigureTAP(ifname, lease, acceptDefaultGW, acceptStaticRoutes, acceptDNS); err != nil {
+		log.Printf("warning: reconfigure tap: %v", err)
+	}
+}
+
 // ConfigurePolicyRoute sets up policy routing so packets from the VPN IP are routed
 // back through the VPN gateway. Needed when the VPN server forwards ports to the
 // client — without it, reply packets use the default route instead of the VPN tunnel.