refactor(proxy): 将 aether-proxy 从 HMAC 正向代理迁移到 WebSocket 隧道模式

移除 HMAC 认证、TLS 自签名证书、HTTP CONNECT 代理和代发(delegate)模式，
改为 aether-proxy 主动通过 WebSocket 连接 Aether 服务端建立隧道。

Aether 服务端新增:
- WebSocket 隧道端点 (proxy_tunnel.py)
- TunnelManager 管理隧道连接和请求分发
- TunnelTransport 作为 httpx 自定义 transport 层
- 基于二进制帧的隧道协议 (tunnel_protocol.py)

aether-proxy (Rust) 重构:
- 新增 tunnel 模块 (client/dispatcher/stream_handler/protocol)
- 支持多 Aether 服务端连接 ([[servers]] 配置)
- 移除 proxy/auth/delegate 模块和 hyper 依赖
- 改用 tokio-tungstenite 实现 WebSocket 客户端

同时:
- 添加浏览器指纹 Headers 绕过 Cloudflare 防护
- 删除节点时自动清理 Provider/Endpoint 的代理引用
- 数据库迁移: 新增 tunnel_mode/tunnel_connected/tunnel_connected_at 字段

aether-proxy/Cargo.toml

@@ -2,19 +2,13 @@
 name = "aether-proxy"
 version = "0.1.6"
 edition = "2021"
-description = "Forward proxy for Aether with HMAC authentication"
+description = "Tunnel proxy for Aether"
 
 [dependencies]
 tokio = { version = "1", features = ["full"] }
-hyper = { version = "1", features = ["http1", "server"] }
-hyper-util = { version = "0.1", features = ["tokio", "http1", "http2", "server", "client-legacy"] }
-tower-service = "0.3"
-http-body-util = "0.1"
 reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls", "stream", "http2"] }
+tokio-tungstenite = { version = "0.24", features = ["rustls-tls-webpki-roots"] }
 futures-util = "0.3"
-hmac = "0.12"
-sha2 = "0.10"
-subtle = "2"
 base64 = "0.22"
 clap = { version = "4", features = ["derive", "env"] }
 tracing = "0.1"
@@ -23,15 +17,11 @@ serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 thiserror = "2"
 bytes = "1"
+sha2 = "0.10"
 hex = "0.4"
 anyhow = "1"
 toml = "0.8"
-tokio-rustls = "0.26"
-webpki-roots = "1"
 rustls = { version = "0.23", features = ["ring"] }
-rustls-pki-types = "1"
-rustls-pemfile = "2"
-rcgen = "0.13"
 ratatui = "0.30"
 crossterm = "0.28"
 url = "2"