Allow a group's gateway file to contain a kernel route-type keyword
(blackhole/unreachable/prohibit/throw) instead of a next-hop. The script
then installs routes of that type (ip route replace <kw> <dst> table N),
so packets are rejected/dropped by the kernel instead of forwarded.

unreachable/prohibit return ICMP to the client, giving instant failure
(curl drops in ~2ms) vs hanging on a dead tunnel.

Used on routes6.d/fr where the France egress (ikev2.fr) is IPv4-only and
no IPv6 path exists: claude.ai AAAA now fast-rejects instead of timing out.
Co-Authored-By: Claude <noreply@anthropic.com>