refactor(proxy): 将 aether-proxy 从 HMAC 正向代理迁移到 WebSocket 隧道模式

移除 HMAC 认证、TLS 自签名证书、HTTP CONNECT 代理和代发(delegate)模式，
改为 aether-proxy 主动通过 WebSocket 连接 Aether 服务端建立隧道。

Aether 服务端新增:
- WebSocket 隧道端点 (proxy_tunnel.py)
- TunnelManager 管理隧道连接和请求分发
- TunnelTransport 作为 httpx 自定义 transport 层
- 基于二进制帧的隧道协议 (tunnel_protocol.py)

aether-proxy (Rust) 重构:
- 新增 tunnel 模块 (client/dispatcher/stream_handler/protocol)
- 支持多 Aether 服务端连接 ([[servers]] 配置)
- 移除 proxy/auth/delegate 模块和 hyper 依赖
- 改用 tokio-tungstenite 实现 WebSocket 客户端

同时:
- 添加浏览器指纹 Headers 绕过 Cloudflare 防护
- 删除节点时自动清理 Provider/Endpoint 的代理引用
- 数据库迁移: 新增 tunnel_mode/tunnel_connected/tunnel_connected_at 字段

alembic/versions/20260224_1700_9a0b1c2d3e4f_add_tunnel_mode_fields.py

@@ -0,0 +1,106 @@
+"""Add tunnel mode fields and remove IP forwarding fields
+
+Revision ID: 9a0b1c2d3e4f
+Revises: 8f9a0b1c2d3e
+Create Date: 2026-02-24 17:00:00.000000
+
+"""
+
+from __future__ import annotations
+
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+from sqlalchemy import inspect
+
+from alembic import op
+
+revision: str = "9a0b1c2d3e4f"
+down_revision: str | None = "8f9a0b1c2d3e"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def column_exists(table_name: str, column_name: str) -> bool:
+    bind = op.get_bind()
+    inspector = inspect(bind)
+    columns = [c["name"] for c in inspector.get_columns(table_name)]
+    return column_name in columns
+
+
+def upgrade() -> None:
+    # 添加 tunnel 模式字段
+    if not column_exists("proxy_nodes", "tunnel_mode"):
+        op.add_column(
+            "proxy_nodes",
+            sa.Column(
+                "tunnel_mode",
+                sa.Boolean(),
+                nullable=False,
+                server_default=sa.text("false"),
+                comment="是否使用 WebSocket 隧道模式",
+            ),
+        )
+    if not column_exists("proxy_nodes", "tunnel_connected"):
+        op.add_column(
+            "proxy_nodes",
+            sa.Column(
+                "tunnel_connected",
+                sa.Boolean(),
+                nullable=False,
+                server_default=sa.text("false"),
+                comment="隧道是否已连接",
+            ),
+        )
+    if not column_exists("proxy_nodes", "tunnel_connected_at"):
+        op.add_column(
+            "proxy_nodes",
+            sa.Column(
+                "tunnel_connected_at",
+                sa.DateTime(timezone=True),
+                nullable=True,
+                comment="隧道最近一次建立时间",
+            ),
+        )
+
+    # tunnel 模式节点不需要 port，将其置零
+    op.execute("UPDATE proxy_nodes SET port = 0 WHERE tunnel_mode = true")
+
+    # 移除旧的 IP 转发字段
+    if column_exists("proxy_nodes", "tls_enabled"):
+        op.drop_column("proxy_nodes", "tls_enabled")
+    if column_exists("proxy_nodes", "tls_cert_fingerprint"):
+        op.drop_column("proxy_nodes", "tls_cert_fingerprint")
+
+
+def downgrade() -> None:
+    # 恢复 IP 转发字段
+    if not column_exists("proxy_nodes", "tls_cert_fingerprint"):
+        op.add_column(
+            "proxy_nodes",
+            sa.Column(
+                "tls_cert_fingerprint",
+                sa.String(128),
+                nullable=True,
+                comment="TLS 证书 SHA-256 指纹（hex）",
+            ),
+        )
+    if not column_exists("proxy_nodes", "tls_enabled"):
+        op.add_column(
+            "proxy_nodes",
+            sa.Column(
+                "tls_enabled",
+                sa.Boolean(),
+                nullable=False,
+                server_default=sa.text("false"),
+                comment="是否启用 TLS 加密",
+            ),
+        )
+
+    # 移除 tunnel 模式字段
+    if column_exists("proxy_nodes", "tunnel_connected_at"):
+        op.drop_column("proxy_nodes", "tunnel_connected_at")
+    if column_exists("proxy_nodes", "tunnel_connected"):
+        op.drop_column("proxy_nodes", "tunnel_connected")
+    if column_exists("proxy_nodes", "tunnel_mode"):
+        op.drop_column("proxy_nodes", "tunnel_mode")