fix: hysteria2 带 pinSHA256 时跳过证书校验

带 pinSHA256 的 hysteria2 节点用自签/SNI 伪装证书(如 sni=www.bing.com),
靠指纹固定校验而非标准 CA 链。Surge 的 server-cert-fingerprint-sha256 实测
不可靠(仍按 SNI 主机名校验并拒绝),故改为输出 skip-cert-verify=true,
与 Shadowrocket 等客户端的实际行为一致。

新增 regen-surge-lines.ts 一次性脚本:从 uri 重新生成所有静态节点的
surge_line(保留自定义名字),修正解析器改动前已存的节点。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/src/parsers/hysteria2.ts

@@ -18,11 +18,17 @@ export function parseHysteria2(uri: string): ParsedNode {
   const sni = params.get('sni') || '';
   const obfs = params.get('obfs') || '';
   const obfsPassword = params.get('obfs-password') || params.get('obfs_password') || '';
+  // pinSHA256 means the node uses a self-signed / SNI-masqueraded cert verified by
+  // fingerprint rather than the standard CA chain. Surge's server-cert-fingerprint-sha256
+  // proved unreliable here (it still validates against the SNI hostname and rejects the
+  // cert), so in that case we skip standard verification — matching the effective behavior
+  // of clients like Shadowrocket that connect fine via pinSHA256.
+  const hasPin = !!(params.get('pinSHA256') || params.get('pinsha256'));
 
   let line = `${name} = hysteria2, ${server}, ${port}, password=${auth}`;
   if (sni) line += `, sni=${sni}`;
   if (obfs === 'salamander' && obfsPassword) line += `, salamander-password=${obfsPassword}`;
-  line += `, skip-cert-verify=${readInsecure(params)}`;
+  line += `, skip-cert-verify=${readInsecure(params) || hasPin}`;
 
   return { name, type: 'hysteria2', server, port, surgeLine: line };
 }