feat: 合并边缘节点运维并完善 Surge 配置安全

迁入通用节点部署工具、离线交付页生成器和共用技能，隔离真实配置与交付产物。统一 Codex 与 Claude Code 开发约定，补充节点迁移与运维文档。

完善 FINAL、策略组引用、输入校验、Surge 字段编码与 AI DNS 例外保护，增加隔离测试和订阅验证工具。

验证：全量类型检查、44 项单测、前端构建、脚本语法、技能入口与凭据隔离检查均通过。

.claude/skills/edge-node-multi-protocol/scripts/00-preflight.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# Verify SSH, record specs, set timezone, install base packages, authorize your key.
+. "$(dirname "$0")/_lib.sh"
+
+echo "== SSH + specs =="
+run 'hostname; . /etc/os-release; echo "$PRETTY_NAME"; nproc; free -m | awk "/Mem/{print \$2\"MB\"}"; df -h / | tail -1'
+
+echo "== timezone (${TZ:-UTC}) + base packages =="
+run "timedatectl set-timezone '${TZ:-UTC}' 2>/dev/null || true
+     export DEBIAN_FRONTEND=noninteractive
+     apt-get update -qq
+     apt-get install -y -qq curl wget gnupg ufw ca-certificates >/dev/null
+     echo base-packages-ok"
+
+# Authorize YOUR public key for passwordless login (edit path if needed).
+MYPUB="$(cat "$HOME/.ssh/id_ed25519.pub" 2>/dev/null || cat "$HOME/.ssh/id_rsa.pub" 2>/dev/null || true)"
+if [ -n "$MYPUB" ]; then
+  run "mkdir -p ~/.ssh && chmod 700 ~/.ssh
+       grep -qF '$MYPUB' ~/.ssh/authorized_keys 2>/dev/null || echo '$MYPUB' >> ~/.ssh/authorized_keys
+       chmod 600 ~/.ssh/authorized_keys; echo authorized-key-added"
+else
+  echo "WARN: no local public key found; add yours to the box manually for passwordless login"
+fi
+echo "preflight done"