拆分服务器地址配置为独立字段，支持CDN优选IP故障切换，新增重置数据库按钮

- model: ServerURL → Protocol/Host/ServerIPs/Port/Path 五个字段
- db: 自动迁移旧 server_url 列到新表结构
- ui: 配置窗口改为横向分组布局，保存失败时不再关闭窗口
- transport: 支持 TLS SNI + Host 头覆盖以连接 CDN 边缘节点
- session: CDN IP 列表连接失败自动切换到下一个
- 新增重置数据库按钮，一键清空所有配置

internal/transport/transport.go

@@ -15,6 +15,7 @@ package transport
 
 import (
 	"context"
+	"crypto/tls"
 	"encoding/json"
 	"fmt"
 	"net/http"
@@ -30,6 +31,7 @@ import (
 // HandshakeConfig configures a single connection attempt.
 type HandshakeConfig struct {
 	ServerURL string // e.g. wss://vpn.example.com/ws
+	SNIHost   string // TLS SNI hostname for CDN edge connections
 	Token     string // JWT; if non-empty, used via ?token= (method A)
 	Username  string // for password auth (method B), or fallback
 	Password  string // for password auth (method B), or fallback
@@ -55,23 +57,30 @@ func Connect(ctx context.Context, cfg HandshakeConfig) (*Conn, error) {
 		WriteBufferSize:  4096, // match server (handler.go:18)
 	}
 
-	// Build URL: append ?token= for JWT auth.
-	url := cfg.ServerURL
-	if cfg.Token != "" {
-		url = appendQuery(url, "token", cfg.Token)
+	if cfg.SNIHost != "" {
+		dialer.TLSClientConfig = &tls.Config{
+			ServerName: cfg.SNIHost,
+		}
+	}
+
+	// Build URL: append ?token= for JWT auth.
+	urlStr := cfg.ServerURL
+	if cfg.Token != "" {
+		urlStr = appendQuery(urlStr, "token", cfg.Token)
 	}
 
-	// Omit Origin header (server allows empty Origin for non-browser
-	// clients — handler.go:19-29).
 	header := http.Header{}
 	header.Set("Origin", "")
+	if cfg.SNIHost != "" {
+		header.Set("Host", cfg.SNIHost)
+	}
 
-	ws, resp, err := dialer.DialContext(ctx, url, header)
+	ws, resp, err := dialer.DialContext(ctx, urlStr, header)
 	if err != nil {
 		if resp != nil {
 			resp.Body.Close()
 		}
-		return nil, fmt.Errorf("dial %s: %w", url, err)
+		return nil, fmt.Errorf("dial %s: %w", urlStr, err)
 	}
 	defer resp.Body.Close()