feat: 添加服务端证书合法性验证（自定义CA/跳过验证/证书固定）

- 新增 internal/tlsconfig 包，集中构建 TLS 配置
- 修复 CDN 边缘 IP 故障转移时 HTTP 登录 TLS 验证失败的问题
- 支持自定义 CA 证书（内联 PEM + 文件路径，合并生效）
- 支持 InsecureSkipVerify 跳过证书验证
- 支持证书固定（SHA-256 指纹校验）
- TLS 验证错误设为不可恢复，避免无限重试
- Profile 编辑界面新增 TLS 设置区域，协议联动启用/禁用
- DB schema v4 迁移，新增 4 个 TLS 字段

internal/auth/auth.go

@@ -6,6 +6,7 @@ package auth
 
 import (
 	"bytes"
+	"crypto/tls"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -41,7 +42,12 @@ type errorResponse struct {
 // baseURL should be the HTTP(S) origin derived from the WebSocket URL
 // (e.g. "http://localhost:8080" for ws://, "https://vpn.example.com"
 // for wss://). See WSURLToHTTP.
-func Login(baseURL, username, password string) (*LoginResult, error) {
+//
+// tlsCfg, if non-nil, is used as the TLS configuration for the HTTP
+// client. This is essential when connecting via CDN edge IPs: the URL
+// host will be an IP address, but the certificate must be verified
+// against the real hostname (set tlsCfg.ServerName).
+func Login(baseURL, username, password string, tlsCfg *tls.Config) (*LoginResult, error) {
 	body, err := json.Marshal(loginRequest{Username: username, Password: password})
 	if err != nil {
 		return nil, err
@@ -49,6 +55,9 @@ func Login(baseURL, username, password string) (*LoginResult, error) {
 
 	url := strings.TrimRight(baseURL, "/") + "/api/login"
 	client := &http.Client{Timeout: 15 * time.Second}
+	if tlsCfg != nil {
+		client.Transport = &http.Transport{TLSClientConfig: tlsCfg}
+	}
 	resp, err := client.Post(url, "application/json", bytes.NewReader(body))
 	if err != nil {
 		return nil, fmt.Errorf("login request: %w", err)