feat: 合并边缘节点运维并完善 Surge 配置安全

迁入通用节点部署工具、离线交付页生成器和共用技能，隔离真实配置与交付产物。统一 Codex 与 Claude Code 开发约定，补充节点迁移与运维文档。

完善 FINAL、策略组引用、输入校验、Surge 字段编码与 AI DNS 例外保护，增加隔离测试和订阅验证工具。

验证：全量类型检查、44 项单测、前端构建、脚本语法、技能入口与凭据隔离检查均通过。

.claude/skills/edge-node-multi-protocol/scripts/04-install-aapanel.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# Install aaPanel International (7.x) headless, then print the default credentials.
+. "$(dirname "$0")/_lib.sh"
+
+run 'cd /root && curl -sSO https://www.aapanel.com/script/install_7.0_en.sh && ls -la install_7.0_en.sh'
+echo "== installing aaPanel in background (5-10 min) =="
+run 'cd /root && (echo y | bash install_7.0_en.sh aapanel > /root/aapanel-install.log 2>&1 &) && echo started'
+
+echo "== waiting for panel binary =="
+# Do NOT check "! pgrep -f install_7.0" here -- the check command's own argv contains
+# that literal string, so pgrep -f matches the check itself and this never goes false.
+# The installer's own log prints a completion banner; watch for that instead.
+until run 'test -f /www/server/panel/BT-Panel && grep -q "Congratulations" /root/aapanel-install.log 2>/dev/null'; do sleep 15; done
+echo "== aaPanel installed. Default credentials (change in 05-harden): =="
+run 'grep -iE "Address|username|password" /root/aapanel-install.log | grep -ivE "wget|Resolving|Connecting|HTTP request|Saving|node.aapanel|systemd" | tail -6'