Windows client installs metric-1 wt0 routes for LAN-native subnet and blackholes native traffic

Do not shadow locally-attached routes (all desktop platforms). Extend the existing BSD-only guard to AddVPNRoute everywhere. Today systemops_generic.go:124-130 skips only legacy exclusion routes on darwin/BSD, while AddVPNRoute (systemops_nonlinux.go:32, systemops_linux.go:175, Windows via systemops_windows.go:262) only calls validateRoute, which allows local subnets. Check isPrefixInLocalSubnets() before genericAddVPNRoute() and skip with a debug log. This fixes Windows/Linux/macOS/BSD with one predicate. Linux advanced-routing already prefers main via rule priority, so the guard is a no-op there; legacy routing and Windows/macOS/BSD need it.

Stop hardcoding Windows metric 1. systemops_windows.go:274 route.Metric = 1 always beats native 256. Even with (1), use a metric that cannot win over directly-connected routes, e.g. read the best non-wt0 candidate via GetBestInterface() and install at native+10, or a high fixed value like 5000 as Tailscale does. This turns any missed guard into latency, not blackhole.

Originally posted by @sayak-brm in https://github.com/netbirdio/netbird/discussions/7565#discussioncomment-18470041