feat: 合并边缘节点运维并完善 Surge 配置安全

迁入通用节点部署工具、离线交付页生成器和共用技能，隔离真实配置与交付产物。统一 Codex 与 Claude Code 开发约定，补充节点迁移与运维文档。

完善 FINAL、策略组引用、输入校验、Surge 字段编码与 AI DNS 例外保护，增加隔离测试和订阅验证工具。

验证：全量类型检查、44 项单测、前端构建、脚本语法、技能入口与凭据隔离检查均通过。

.claude/skills/edge-node-multi-protocol/scripts/00-preflight-sg.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+# No-aaPanel preflight for the SG node: verify SSH, add swap (low-RAM box),
+# set timezone, install nginx + acme deps directly from apt, authorize your key.
+. "$(dirname "$0")/_lib.sh"
+
+echo "== SSH + specs =="
+run 'hostname; . /etc/os-release; echo "$PRETTY_NAME"; nproc; free -m | awk "/Mem/{print \$2\"MB\"}"; df -h / | tail -1'
+
+echo "== swap (2G, low-RAM box needs it for installs) =="
+run 'if ! swapon --show | grep -q /swapfile; then
+       fallocate -l 2G /swapfile || dd if=/dev/zero of=/swapfile bs=1M count=2048
+       chmod 600 /swapfile; mkswap /swapfile >/dev/null; swapon /swapfile
+       grep -q "/swapfile" /etc/fstab || echo "/swapfile none swap sw 0 0" >> /etc/fstab
+       sysctl -w vm.swappiness=10 >/dev/null
+       grep -q "vm.swappiness" /etc/sysctl.conf || echo "vm.swappiness=10" >> /etc/sysctl.conf
+     fi
+     free -h | awk "/Swap/{print \"swap: \"\$2}"'
+
+echo "== timezone (${TZ:-UTC}) + base packages (nginx, acme deps) =="
+run "timedatectl set-timezone '${TZ:-UTC}' 2>/dev/null || true
+     export DEBIAN_FRONTEND=noninteractive
+     # Freshly-booted cloud images run unattended-upgrades, which holds the dpkg lock
+     # for minutes; without this wait apt fails while the script reports success.
+     for i in \$(seq 1 60); do
+       fuser /var/lib/dpkg/lock-frontend >/dev/null 2>&1 || break
+       [ \$i = 1 ] && echo 'waiting for dpkg lock (unattended-upgrades)...'
+       sleep 10
+     done
+     apt-get update -qq
+     apt-get install -y -qq curl wget gnupg ufw ca-certificates socat cron nginx >/dev/null || { echo 'ERROR: apt install failed'; exit 1; }
+     command -v nginx >/dev/null || { echo 'ERROR: nginx missing after install'; exit 1; }
+     systemctl enable --now nginx >/dev/null 2>&1 || true
+     nginx -v 2>&1
+     echo base-packages-ok"
+
+# BBR + fq. Stock cloud images generally do NOT have it: this AWS Ubuntu 24.04 AMI
+# came up on cubic + fq_codel with tcp_bbr not even loaded, while the DMIT box ships
+# BBR pre-enabled in its VM template. Lifts every TCP inbound at once, no client change.
+echo "== kernel tuning: BBR congestion control =="
+run 'modprobe tcp_bbr 2>/dev/null || true
+     echo tcp_bbr > /etc/modules-load.d/tcp_bbr.conf
+     cat > /etc/sysctl.d/99-edge-node-bbr.conf <<CONF
+net.core.default_qdisc = fq
+net.ipv4.tcp_congestion_control = bbr
+CONF
+     sysctl --system >/dev/null 2>&1
+     CC=$(sysctl -n net.ipv4.tcp_congestion_control)
+     QD=$(sysctl -n net.core.default_qdisc)
+     echo "congestion=$CC qdisc=$QD"
+     [ "$CC" = bbr ] || echo "WARN: BBR not active — kernel may lack tcp_bbr (available: $(sysctl -n net.ipv4.tcp_available_congestion_control))"'
+
+# Authorize YOUR public key for passwordless login.
+MYPUB="$(cat "$HOME/.ssh/id_ed25519.pub" 2>/dev/null || cat "$HOME/.ssh/id_rsa.pub" 2>/dev/null || true)"
+if [ -n "$MYPUB" ]; then
+  run "mkdir -p ~/.ssh && chmod 700 ~/.ssh
+       grep -qF '$MYPUB' ~/.ssh/authorized_keys 2>/dev/null || echo '$MYPUB' >> ~/.ssh/authorized_keys
+       chmod 600 ~/.ssh/authorized_keys; echo authorized-key-added"
+else
+  echo "WARN: no local public key found; add yours to the box manually"
+fi
+echo "preflight done"