feat: 合并边缘节点运维并完善 Surge 配置安全

迁入通用节点部署工具、离线交付页生成器和共用技能，隔离真实配置与交付产物。统一 Codex 与 Claude Code 开发约定，补充节点迁移与运维文档。

完善 FINAL、策略组引用、输入校验、Surge 字段编码与 AI DNS 例外保护，增加隔离测试和订阅验证工具。

验证：全量类型检查、44 项单测、前端构建、脚本语法、技能入口与凭据隔离检查均通过。

docs/SURGE-FIX-2026-10-03.verification.json

@@ -0,0 +1,68 @@
+{
+  "surge": {
+    "httpStatus": 200,
+    "candidateExactByteMatch": true,
+    "bytes": 24963,
+    "sha256": "0c12a56f72bbc0e1b116570bbcccd2208cdd1ca06568391a7769728ae5499caf",
+    "nativeExitCode": 0,
+    "rulesetSnapshotCliExitCode": 0
+  },
+  "clash": {
+    "httpStatus": 200,
+    "candidateExactByteMatch": true,
+    "bytes": 25971,
+    "sha256": "98ff38b94544315bea8782344fa7a547c209be876653382fb3ebe78f45a002dd",
+    "nativeExitCode": 0
+  },
+  "shadowrocket-conf": {
+    "httpStatus": 200,
+    "candidateExactByteMatch": true,
+    "bytes": 12426,
+    "sha256": "90684cac8b1fb99df6b22b3629f5fab81a72f1bbf39e5fed4351494d819b783a"
+  },
+  "backup": {
+    "file": "before-surge-audit-fix-20261003-223218.db"
+  },
+  "schemaVersion": 1,
+  "date": "2026-10-03",
+  "client": {
+    "SurgeMac": "6.9.1",
+    "build": "12290"
+  },
+  "checks": {
+    "typecheck": "all packages passed",
+    "vitestPassed": 44,
+    "nativeSyntheticProfiles": 6,
+    "webBuild": "passed",
+    "schemaValidatedObjects": 160,
+    "rulesetDownloads": 60,
+    "domainShadowingWarnings": 0,
+    "skillValidation": "passed",
+    "apiHelperMockValidation": "passed"
+  },
+  "productionCounts": {
+    "nodes": 30,
+    "groups": 14,
+    "members": 32,
+    "rules": 116,
+    "enabledRules": 115,
+    "rulesets": 62,
+    "tokens": 1,
+    "settings": 6,
+    "surgeNodes": 22,
+    "excludedShadowsocksWebSocket": 8
+  },
+  "apiWrites": [
+    200,
+    200,
+    200
+  ],
+  "backupQuickCheck": "ok",
+  "deployment": {
+    "workingTreeUncommitted": true,
+    "gitHeadBasis": "7358008",
+    "frontendFingerprintPrefix": "e11cf89c7ea8",
+    "backendFingerprintPrefix": "062622032ebd"
+  },
+  "deviceTrafficValidated": false
+}