feat: 合并边缘节点运维并完善 Surge 配置安全

迁入通用节点部署工具、离线交付页生成器和共用技能，隔离真实配置与交付产物。统一 Codex 与 Claude Code 开发约定，补充节点迁移与运维文档。

完善 FINAL、策略组引用、输入校验、Surge 字段编码与 AI DNS 例外保护，增加隔离测试和订阅验证工具。

验证：全量类型检查、44 项单测、前端构建、脚本语法、技能入口与凭据隔离检查均通过。

server/src/routes/groups.ts

@@ -5,7 +5,12 @@ import { nanoid } from 'nanoid';
 import { z } from 'zod';
 import { groupInputSchema, type GroupDto } from '@proxy-station/shared';
 import { db } from '../db/index.js';
-import { groupMembers, policyGroups, rules } from '../db/schema.js';
+import { groupMembers, policyGroups, rules, nodes } from '../db/schema.js';
+import { groupError } from '../services/group-validation.js';
+
+function validate(input: z.output<typeof groupInputSchema>, id?: string): string | null {
+  return groupError(input, loadGroups(), db.select({ id: nodes.id, name: nodes.name }).from(nodes).all(), id);
+}
 
 function loadGroups(): GroupDto[] {
   const groups = db.select().from(policyGroups).orderBy(asc(policyGroups.sortOrder)).all();
@@ -37,27 +42,31 @@ export const groupsRoute = new Hono()
   .get('/', (c) => c.json(loadGroups()))
   .post('/', zValidator('json', groupInputSchema), (c) => {
     const input = c.req.valid('json');
+    const error = validate(input);
+    if (error) return c.json({ error }, error === '策略组名称已存在' ? 409 : 400);
     const id = nanoid(10);
     try {
-      db.insert(policyGroups)
-        .values({
-          id,
-          name: input.name,
-          type: input.type,
-          testUrl: input.testUrl ?? null,
-          interval: input.interval ?? null,
-          tolerance: input.tolerance ?? null,
-          filterRegex: input.filterRegex || null,
-          includeAllNodes: input.includeAllNodes,
-          sortOrder: input.sortOrder,
-          source: 'custom',
-        })
-        .run();
+      db.transaction(() => {
+        db.insert(policyGroups)
+          .values({
+            id,
+            name: input.name,
+            type: input.type,
+            testUrl: input.testUrl ?? null,
+            interval: input.interval ?? null,
+            tolerance: input.tolerance ?? null,
+            filterRegex: input.filterRegex || null,
+            includeAllNodes: input.includeAllNodes,
+            sortOrder: input.sortOrder,
+            source: 'custom',
+          })
+          .run();
+        replaceMembers(id, input.members);
+      });
     } catch (e: any) {
       if (String(e.message).includes('UNIQUE')) return c.json({ error: `策略组「${input.name}」已存在` }, 409);
       throw e;
     }
-    replaceMembers(id, input.members);
     return c.json({ id }, 201);
   })
   .put('/reorder', zValidator('json', z.object({ ids: z.array(z.string()) })), (c) => {
@@ -79,25 +88,29 @@ export const groupsRoute = new Hono()
     const existing = db.select().from(policyGroups).where(eq(policyGroups.id, id)).get();
     if (!existing) return c.json({ error: '策略组不存在' }, 404);
     const input = c.req.valid('json');
+    const error = validate(input, id);
+    if (error) return c.json({ error }, error === '策略组名称已存在' ? 409 : 400);
     const oldName = existing.name;
-    db.update(policyGroups)
-      .set({
-        name: input.name,
-        type: input.type,
-        testUrl: input.testUrl ?? null,
-        interval: input.interval ?? null,
-        tolerance: input.tolerance ?? null,
-        filterRegex: input.filterRegex || null,
-        includeAllNodes: input.includeAllNodes,
-      })
-      .where(eq(policyGroups.id, id))
-      .run();
-    replaceMembers(id, input.members);
-    // 组名变更时同步引用它的成员与规则策略
-    if (oldName !== input.name) {
-      db.update(groupMembers).set({ refName: input.name }).where(eq(groupMembers.refName, oldName)).run();
-      db.update(rules).set({ policy: input.name }).where(eq(rules.policy, oldName)).run();
-    }
+    db.transaction(() => {
+      db.update(policyGroups)
+        .set({
+          name: input.name,
+          type: input.type,
+          testUrl: input.testUrl ?? null,
+          interval: input.interval ?? null,
+          tolerance: input.tolerance ?? null,
+          filterRegex: input.filterRegex || null,
+          includeAllNodes: input.includeAllNodes,
+        })
+        .where(eq(policyGroups.id, id))
+        .run();
+      replaceMembers(id, input.members.map((m) => m.kind === 'group' && m.refName === oldName ? { ...m, refName: input.name } : m));
+      // 组名变更时同步引用它的成员与规则策略
+      if (oldName !== input.name) {
+        db.update(groupMembers).set({ refName: input.name }).where(eq(groupMembers.refName, oldName)).run();
+        db.update(rules).set({ policy: input.name }).where(eq(rules.policy, oldName)).run();
+      }
+    });
     return c.json({ ok: true });
   })
   .delete('/:id', (c) => {