refactor(proxy): 将 aether-proxy 从 HMAC 正向代理迁移到 WebSocket 隧道模式

移除 HMAC 认证、TLS 自签名证书、HTTP CONNECT 代理和代发(delegate)模式，
改为 aether-proxy 主动通过 WebSocket 连接 Aether 服务端建立隧道。

Aether 服务端新增:
- WebSocket 隧道端点 (proxy_tunnel.py)
- TunnelManager 管理隧道连接和请求分发
- TunnelTransport 作为 httpx 自定义 transport 层
- 基于二进制帧的隧道协议 (tunnel_protocol.py)

aether-proxy (Rust) 重构:
- 新增 tunnel 模块 (client/dispatcher/stream_handler/protocol)
- 支持多 Aether 服务端连接 ([[servers]] 配置)
- 移除 proxy/auth/delegate 模块和 hyper 依赖
- 改用 tokio-tungstenite 实现 WebSocket 客户端

同时:
- 添加浏览器指纹 Headers 绕过 Cloudflare 防护
- 删除节点时自动清理 Provider/Endpoint 的代理引用
- 数据库迁移: 新增 tunnel_mode/tunnel_connected/tunnel_connected_at 字段

aether-proxy/src/registration/client.rs

@@ -3,30 +3,11 @@ use std::time::{Duration, SystemTime, UNIX_EPOCH};
 use reqwest::{Client, StatusCode};
 use serde::{Deserialize, Serialize};
 use tokio::time::sleep;
-use tracing::{debug, error, info, warn};
+use tracing::{debug, error, info};
 
 use crate::config::Config;
 use crate::hardware::HardwareInfo;
 
-/// Heartbeat-specific error that distinguishes "node not found" (needs
-/// re-registration) from transient / other failures.
-#[derive(Debug)]
-pub enum HeartbeatError {
-    /// HTTP 404 – the node_id is no longer known to Aether.
-    NodeNotFound(String),
-    /// Any other failure (network, 5xx, etc.).
-    Other(anyhow::Error),
-}
-
-impl std::fmt::Display for HeartbeatError {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::NodeNotFound(msg) => write!(f, "node not found: {}", msg),
-            Self::Other(e) => write!(f, "{}", e),
-        }
-    }
-}
-
 #[derive(Debug, Serialize)]
 struct RegisterRequest {
     name: String,
@@ -35,14 +16,11 @@ struct RegisterRequest {
     #[serde(skip_serializing_if = "Option::is_none")]
     region: Option<String>,
     heartbeat_interval: u64,
-    #[serde(skip_serializing_if = "std::ops::Not::not")]
-    tls_enabled: bool,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    tls_cert_fingerprint: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
     hardware_info: Option<serde_json::Value>,
     #[serde(skip_serializing_if = "Option::is_none")]
     estimated_max_concurrency: Option<u64>,
+    tunnel_mode: bool,
 }
 
 #[derive(Debug, Deserialize)]
@@ -50,17 +28,6 @@ pub struct RegisterResponse {
     pub node_id: String,
 }
 
-#[derive(Debug, Serialize)]
-struct HeartbeatRequest {
-    node_id: String,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    active_connections: Option<i64>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    total_requests: Option<i64>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    avg_latency_ms: Option<f64>,
-}
-
 /// Remote configuration pushed by the Aether management backend.
 #[derive(Debug, Clone, Deserialize)]
 pub struct RemoteConfig {
@@ -68,29 +35,6 @@ pub struct RemoteConfig {
     pub allowed_ports: Option<Vec<u16>>,
     pub log_level: Option<String>,
     pub heartbeat_interval: Option<u64>,
-    pub timestamp_tolerance: Option<u64>,
-}
-
-/// Parsed heartbeat response from Aether.
-#[derive(Debug, Deserialize)]
-struct HeartbeatResponseBody {
-    #[serde(default)]
-    node: Option<HeartbeatNodeInfo>,
-}
-
-#[derive(Debug, Deserialize)]
-struct HeartbeatNodeInfo {
-    #[serde(default)]
-    remote_config: Option<RemoteConfig>,
-    #[serde(default)]
-    config_version: Option<u64>,
-}
-
-/// Heartbeat result returned to the caller.
-#[derive(Debug)]
-pub struct HeartbeatResult {
-    pub remote_config: Option<RemoteConfig>,
-    pub config_version: u64,
 }
 
 #[derive(Debug, Serialize)]
@@ -109,7 +53,7 @@ pub struct AetherClient {
 }
 
 impl AetherClient {
-    pub fn new(config: &Config) -> Self {
+    pub fn new(config: &Config, aether_url: &str, management_token: &str) -> Self {
         let mut builder = Client::builder()
             .timeout(Duration::from_secs(config.aether_request_timeout_secs))
             .connect_timeout(Duration::from_secs(config.aether_connect_timeout_secs))
@@ -136,8 +80,8 @@ impl AetherClient {
 
         Self {
             http,
-            base_url: config.aether_url.trim_end_matches('/').to_string(),
-            token: config.management_token.clone(),
+            base_url: aether_url.trim_end_matches('/').to_string(),
+            token: management_token.to_string(),
             retry_max_attempts: config.aether_retry_max_attempts.max(1),
             retry_base_delay,
             retry_max_delay,
@@ -150,29 +94,26 @@ impl AetherClient {
     pub async fn register(
         &self,
         config: &Config,
+        node_name: &str,
         public_ip: &str,
-        tls_enabled: bool,
-        tls_cert_fingerprint: Option<&str>,
         hw: Option<&HardwareInfo>,
     ) -> anyhow::Result<String> {
         let url = format!("{}/api/admin/proxy-nodes/register", self.base_url);
         let body = RegisterRequest {
-            name: config.node_name.clone(),
+            name: node_name.to_string(),
             ip: public_ip.to_string(),
-            port: config.listen_port,
+            port: 0,
             region: config.node_region.clone(),
             heartbeat_interval: config.heartbeat_interval,
-            tls_enabled,
-            tls_cert_fingerprint: tls_cert_fingerprint.map(|s| s.to_string()),
             hardware_info: hw.and_then(|h| serde_json::to_value(h).ok()),
             estimated_max_concurrency: hw.map(|h| h.estimated_max_concurrency),
+            tunnel_mode: true,
         };
 
         info!(
             url = %url,
             name = %body.name,
             ip = %body.ip,
-            port = body.port,
             "registering with Aether"
         );
 
@@ -199,80 +140,6 @@ impl AetherClient {
         Ok(data.node_id)
     }
 
-    /// Send heartbeat to Aether.
-    ///
-    /// On success, returns any remote config included in the response.
-    /// Returns [`HeartbeatError::NodeNotFound`] on HTTP 404 so the caller
-    /// can trigger re-registration.
-    pub async fn heartbeat(
-        &self,
-        node_id: &str,
-        active_connections: Option<i64>,
-        total_requests: Option<i64>,
-        avg_latency_ms: Option<f64>,
-    ) -> Result<HeartbeatResult, HeartbeatError> {
-        let url = format!("{}/api/admin/proxy-nodes/heartbeat", self.base_url);
-        let body = HeartbeatRequest {
-            node_id: node_id.to_string(),
-            active_connections,
-            total_requests,
-            avg_latency_ms,
-        };
-
-        debug!(node_id = %node_id, "sending heartbeat");
-
-        let resp = self
-            .send_with_retry(
-                || {
-                    self.http
-                        .post(&url)
-                        .header("Authorization", format!("Bearer {}", self.token))
-                        .json(&body)
-                },
-                "heartbeat",
-            )
-            .await
-            .map_err(|e| HeartbeatError::Other(e.into()))?;
-
-        let status = resp.status();
-        if !status.is_success() {
-            let text = resp.text().await.unwrap_or_default();
-            warn!(status = %status, body = %text, "heartbeat failed");
-            if status == StatusCode::NOT_FOUND {
-                return Err(HeartbeatError::NodeNotFound(text));
-            }
-            return Err(HeartbeatError::Other(anyhow::anyhow!(
-                "heartbeat failed (HTTP {}): {}",
-                status,
-                text
-            )));
-        }
-
-        // Parse remote config from response (best-effort)
-        let result = match resp.json::<HeartbeatResponseBody>().await {
-            Ok(body) => {
-                let (remote_config, config_version) = match body.node {
-                    Some(node) => (node.remote_config, node.config_version.unwrap_or(0)),
-                    None => (None, 0),
-                };
-                HeartbeatResult {
-                    remote_config,
-                    config_version,
-                }
-            }
-            Err(e) => {
-                debug!(error = %e, "failed to parse heartbeat response body");
-                HeartbeatResult {
-                    remote_config: None,
-                    config_version: 0,
-                }
-            }
-        };
-
-        debug!(node_id = %node_id, config_version = result.config_version, "heartbeat ok");
-        Ok(result)
-    }
-
     /// Unregister this node from Aether (graceful shutdown).
     pub async fn unregister(&self, node_id: &str) -> anyhow::Result<()> {
         let url = format!("{}/api/admin/proxy-nodes/unregister", self.base_url);

aether-proxy/src/registration/heartbeat.rs

@@ -1,127 +0,0 @@
-use std::sync::atomic::Ordering;
-use std::sync::Arc;
-
-use tokio::sync::watch;
-use tracing::{debug, error, info, warn};
-
-use crate::registration::client::HeartbeatError;
-use crate::runtime;
-use crate::state::AppState;
-
-/// Run periodic heartbeat task until shutdown signal.
-///
-/// When Aether responds with 404 (node not found), this task automatically
-/// re-registers the node and updates the shared `node_id` so the proxy
-/// server and future heartbeats use the new identity.
-///
-/// When the heartbeat response includes a `remote_config`, it is applied
-/// to the [`DynamicConfig`](crate::runtime::DynamicConfig) so the proxy
-/// picks up changes without a restart.
-pub async fn run(state: &Arc<AppState>, mut shutdown_rx: watch::Receiver<bool>) {
-    let mut consecutive_failures: u32 = 0;
-
-    // Skip the first tick (registration already acts as initial heartbeat)
-    let initial_interval = state.dynamic.read().unwrap().heartbeat_interval;
-    tokio::select! {
-        _ = tokio::time::sleep(std::time::Duration::from_secs(initial_interval)) => {}
-        _ = shutdown_rx.changed() => {
-            debug!("heartbeat task stopping (during initial wait)");
-            return;
-        }
-    }
-
-    loop {
-        let current_node_id = state.node_id.read().unwrap().clone();
-        let active_conns = state.active_connections.load(Ordering::Relaxed) as i64;
-
-        // Swap-and-reset: report incremental metrics since last heartbeat
-        let interval_requests = state.metrics.total_requests.swap(0, Ordering::Relaxed);
-        let interval_latency_ns = state.metrics.total_latency_ns.swap(0, Ordering::Relaxed);
-        let interval_requests_i64 = i64::try_from(interval_requests).unwrap_or(i64::MAX);
-        let avg_latency_ms = if interval_requests > 0 {
-            Some(interval_latency_ns as f64 / interval_requests as f64 / 1_000_000.0)
-        } else {
-            None
-        };
-
-        match state
-            .aether_client
-            .heartbeat(
-                &current_node_id,
-                Some(active_conns),
-                Some(interval_requests_i64),
-                avg_latency_ms,
-            )
-            .await
-        {
-            Ok(result) => {
-                if consecutive_failures > 0 {
-                    info!(
-                        previous_failures = consecutive_failures,
-                        "heartbeat recovered"
-                    );
-                }
-                consecutive_failures = 0;
-
-                // Apply remote config if present and version changed
-                if let Some(ref remote) = result.remote_config {
-                    runtime::apply_remote_config(&state.dynamic, remote, result.config_version);
-                }
-            }
-            Err(HeartbeatError::NodeNotFound(_)) => {
-                warn!(
-                    old_node_id = %current_node_id,
-                    "node not found, re-registering"
-                );
-                match state
-                    .aether_client
-                    .register(
-                        &state.config,
-                        &state.public_ip,
-                        state.config.enable_tls,
-                        state.tls_fingerprint.as_deref(),
-                        Some(&state.hardware_info),
-                    )
-                    .await
-                {
-                    Ok(new_id) => {
-                        info!(
-                            old_node_id = %current_node_id,
-                            new_node_id = %new_id,
-                            "re-registered successfully"
-                        );
-                        *state.node_id.write().unwrap() = new_id;
-                        consecutive_failures = 0;
-                    }
-                    Err(e) => {
-                        consecutive_failures += 1;
-                        error!(
-                            error = %e,
-                            consecutive_failures,
-                            "re-registration failed"
-                        );
-                    }
-                }
-            }
-            Err(HeartbeatError::Other(e)) => {
-                consecutive_failures += 1;
-                warn!(
-                    error = %e,
-                    consecutive_failures,
-                    "heartbeat failed"
-                );
-            }
-        }
-
-        // Read interval from dynamic config (may have been updated remotely)
-        let interval_secs = state.dynamic.read().unwrap().heartbeat_interval;
-
-        tokio::select! {
-            _ = tokio::time::sleep(std::time::Duration::from_secs(interval_secs)) => {}
-            _ = shutdown_rx.changed() => {
-                debug!("heartbeat task stopping");
-                break;
-            }
-        }
-    }
-}

aether-proxy/src/registration/mod.rs

@@ -1,2 +1 @@
 pub mod client;
-pub mod heartbeat;