fix(mihomo): keep the proxy up when the resolved hook times out

On shoukei a DNS takeover that timed out failed mihomo.service, and the
nixpkgs unit has no Restart=, so the proxy stayed down. Prefix the hook
with '-' (fail open, like ai's hook). Also switch the dashboard title
patch to --replace-fail.

Assisted-by: Claude Code (claude-opus-5-5)

modules/nixos/desktop/networking/mihomo/default.nix

@@ -30,7 +30,7 @@ let
     cp -r ${pkgs.metacubexd} $out
     chmod -R u+w $out
     substituteInPlace $out/index.html $out/200.html $out/404.html \
-      --replace '<title>MetaCubeXD</title>' '<title>MetaCubeXD · ${host}</title>'
+      --replace-fail '<title>MetaCubeXD</title>' '<title>MetaCubeXD · ${host}</title>'
     cat >> $out/config.js <<'EOF'
 
     ;(function () {
@@ -91,7 +91,8 @@ in
       # Attach the catch-all to the TUN, leaving DHCP and more-specific VPN DNS
       # routes untouched. Removing the TUN also removes its resolved settings.
       # '+' allows the privileged D-Bus call outside mihomo's service sandbox.
-      ExecStartPost = "+${pkgs.coreutils}/bin/timeout 30 ${
+      # '-': a timed-out hook must not take the proxy down with it.
+      ExecStartPost = "-+${pkgs.coreutils}/bin/timeout 30 ${
         lib.getExe (
           pkgs.writeShellApplication {
             name = "mihomo-resolved";