feat: 合并边缘节点运维并完善 Surge 配置安全

迁入通用节点部署工具、离线交付页生成器和共用技能，隔离真实配置与交付产物。统一 Codex 与 Claude Code 开发约定，补充节点迁移与运维文档。

完善 FINAL、策略组引用、输入校验、Surge 字段编码与 AI DNS 例外保护，增加隔离测试和订阅验证工具。

验证：全量类型检查、44 项单测、前端构建、脚本语法、技能入口与凭据隔离检查均通过。

.claude/skills/edge-node-multi-protocol/scripts/03-sign-wildcard-cert.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# Issue a wildcard cert for *.<DOMAIN_ROOT> on the box via acme.sh DNS-01,
+# deploy into the aaPanel BT cert dirs, and register a renew --reloadcmd.
+# DNS provider is set by ACME_DNS_PLUGIN (default dns_cf); creds are passed through from config.env.
+# Fleet alternative (sign once, scp to many): references/centralized-certs.md
+. "$(dirname "$0")/_lib.sh"
+
+PLUGIN="${ACME_DNS_PLUGIN:-dns_cf}"
+# Export whichever acme.sh DNS credential vars are set in config.env (only non-empty ones).
+CRED_EXPORTS=""
+for v in CF_API_TOKEN CF_Zone_ID DP_Id DP_Key Ali_Key Ali_Secret AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY GD_Key GD_Secret; do
+  [ -n "${!v:-}" ] && CRED_EXPORTS+="export $v='${!v}'; "
+done
+# acme.sh's Cloudflare plugin expects CF_Token, so alias it from CF_API_TOKEN.
+[ -n "${CF_API_TOKEN:-}" ] && CRED_EXPORTS+="export CF_Token='${CF_API_TOKEN}'; "
+
+SITES=("$DOMAIN_ROOT" "$SUB_COVER.$DOMAIN_ROOT" "$SUB_XUI.$DOMAIN_ROOT" "$SUB_PANEL.$DOMAIN_ROOT")
+SITES_CSV=$(IFS=,; echo "${SITES[*]}")
+
+run "$CRED_EXPORTS
+  curl -s https://get.acme.sh | sh -s email=admin@$PARENT_ZONE >/dev/null 2>&1 || true
+  ~/.acme.sh/acme.sh --set-default-ca --server letsencrypt >/dev/null 2>&1 || true
+  ~/.acme.sh/acme.sh --issue --dns $PLUGIN -d '$DOMAIN_ROOT' -d '*.$DOMAIN_ROOT' --keylength ec-256 --server letsencrypt 2>&1 | tail -4
+
+  # deploy into BT cert dirs + reload nginx
+  SRC=~/.acme.sh/${DOMAIN_ROOT}_ecc
+  for s in ${SITES_CSV//,/ }; do
+    d=/www/server/panel/vhost/cert/\$s; mkdir -p \$d
+    install -m 644 \$SRC/fullchain.cer \$d/fullchain.pem
+    install -m 600 \$SRC/${DOMAIN_ROOT}.key \$d/privkey.pem
+  done
+  ( /www/server/nginx/sbin/nginx -t && /www/server/nginx/sbin/nginx -s reload ) 2>/dev/null || echo 'nginx not up yet (fine — reload after aaPanel install)'
+
+  # register reloadcmd so renewals re-deploy automatically
+  ~/.acme.sh/acme.sh --install-cert -d '$DOMAIN_ROOT' --ecc \
+    --reloadcmd \"for s in ${SITES_CSV//,/ }; do d=/www/server/panel/vhost/cert/\\\$s; install -m 644 \\\$SRC/fullchain.cer \\\$d/fullchain.pem; install -m 600 \\\$SRC/${DOMAIN_ROOT}.key \\\$d/privkey.pem; done; /www/server/nginx/sbin/nginx -s reload\" 2>&1 | tail -2
+  echo cert-done"