feat: 添加服务端证书合法性验证（自定义CA/跳过验证/证书固定）

- 新增 internal/tlsconfig 包，集中构建 TLS 配置
- 修复 CDN 边缘 IP 故障转移时 HTTP 登录 TLS 验证失败的问题
- 支持自定义 CA 证书（内联 PEM + 文件路径，合并生效）
- 支持 InsecureSkipVerify 跳过证书验证
- 支持证书固定（SHA-256 指纹校验）
- TLS 验证错误设为不可恢复，避免无限重试
- Profile 编辑界面新增 TLS 设置区域，协议联动启用/禁用
- DB schema v4 迁移，新增 4 个 TLS 字段

internal/daemon/daemon.go

@@ -131,16 +131,20 @@ func (d *daemon) startSession(conn net.Conn, req ipc.Request) {
 	}
 
 	cfg := vpn.SessionConfig{
-		ServerURL:   req.Config.ServerURL,
-		SNIHost:     req.Config.SNIHost,
-		ServerIPs:   req.Config.ServerIPs,
-		Username:    req.Config.Username,
-		Password:    req.Config.Password,
-		Token:       req.Config.Token,
-		AuthMode:    model.AuthMode(req.Config.AuthMode),
-		RoutingMode: ipc.RoutingModeFromIPC(req.Config.RoutingMode),
-		CustomCIDRs: req.Config.CustomCIDRs,
-		MTUOverride: req.Config.MTUOverride,
+		ServerURL:     req.Config.ServerURL,
+		SNIHost:       req.Config.SNIHost,
+		ServerIPs:     req.Config.ServerIPs,
+		Username:      req.Config.Username,
+		Password:      req.Config.Password,
+		Token:         req.Config.Token,
+		AuthMode:      model.AuthMode(req.Config.AuthMode),
+		RoutingMode:   ipc.RoutingModeFromIPC(req.Config.RoutingMode),
+		CustomCIDRs:   req.Config.CustomCIDRs,
+		MTUOverride:   req.Config.MTUOverride,
+		TLSCACert:     req.Config.TLSCACert,
+		TLSCAPath:     req.Config.TLSCAPath,
+		TLSInsecure:   req.Config.TLSInsecure,
+		TLSPinnedHash: req.Config.TLSPinnedHash,
 	}
 
 	ctx, cancel := context.WithCancel(context.Background())