feat: 添加 WireGuard 设备管理并完善客户端分流

实现独立加密设备身份、网关 agent、持久生命周期任务和 Surge/FlClash 专属订阅凭证。

完善 Shadowrocket 规则转换与 Clash AI DNS，增加 Surge FFSB 适配、规则快照、运维工具及验收文档。

server/assets/ffsb-domains.json

@@ -0,0 +1,27 @@
+[
+  "*.anthropic.com",
+  "*.clau.de",
+  "*.claude.com",
+  "*.claudemcpclient.com",
+  "*.claudemcpcontent.com",
+  "*.claudeusercontent.com",
+  "*.ffsb.sg",
+  "a.claude.ai",
+  "anthropic.com",
+  "api.anthropic.com",
+  "api.ipify.org",
+  "assets.claude.ai",
+  "clau.de",
+  "claude.ai",
+  "claude.com",
+  "claudemcpclient.com",
+  "claudemcpcontent.com",
+  "claudeusercontent.com",
+  "ffsb.sg",
+  "icanhazip.com",
+  "ifconfig.me",
+  "ip.net.coffee",
+  "join.fufeishangban.com",
+  "pivot.claude.ai",
+  "www.claude.ai"
+]