feat: 合并边缘节点运维并完善 Surge 配置安全

迁入通用节点部署工具、离线交付页生成器和共用技能，隔离真实配置与交付产物。统一 Codex 与 Claude Code 开发约定，补充节点迁移与运维文档。

完善 FINAL、策略组引用、输入校验、Surge 字段编码与 AI DNS 例外保护，增加隔离测试和订阅验证工具。

验证：全量类型检查、44 项单测、前端构建、脚本语法、技能入口与凭据隔离检查均通过。

.claude/skills/edge-node-multi-protocol/scripts/10-ufw-sg.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# Firewall: only 22/80/443 need to be public (all 6 inbounds + 3x-ui are 127.0.0.1-only,
+# reverse-proxied through nginx on 443). NOTE: on AWS the Security Group is the outer gate
+# and must also allow inbound 22/80/443 — ufw alone is not enough.
+. "$(dirname "$0")/_lib.sh"
+
+run 'for p in 22 80 443; do ufw allow "$p"/tcp >/dev/null 2>&1; done
+     yes | ufw enable >/dev/null 2>&1 || true
+     ufw status verbose | grep -E "22|80|443|Status"'