feat: 添加服务端证书合法性验证（自定义CA/跳过验证/证书固定）

- 新增 internal/tlsconfig 包，集中构建 TLS 配置
- 修复 CDN 边缘 IP 故障转移时 HTTP 登录 TLS 验证失败的问题
- 支持自定义 CA 证书（内联 PEM + 文件路径，合并生效）
- 支持 InsecureSkipVerify 跳过证书验证
- 支持证书固定（SHA-256 指纹校验）
- TLS 验证错误设为不可恢复，避免无限重试
- Profile 编辑界面新增 TLS 设置区域，协议联动启用/禁用
- DB schema v4 迁移，新增 4 个 TLS 字段

internal/db/db.go

@@ -48,7 +48,10 @@ func (s *Store) migrate() error {
 	if err := s.migrateV2(); err != nil {
 		return err
 	}
-	return s.migrateV3()
+	if err := s.migrateV3(); err != nil {
+		return err
+	}
+	return s.migrateV4()
 }
 
 func (s *Store) migrateV2() error {
@@ -181,6 +184,29 @@ func (s *Store) migrateV3() error {
 	return nil
 }
 
+// migrateV4 adds TLS certificate verification columns to
+// server_profiles for custom CA, insecure mode, and cert pinning.
+// Idempotent: skips columns that already exist.
+func (s *Store) migrateV4() error {
+	cols := []struct {
+		name string
+		sql  string
+	}{
+		{"tls_ca_cert", "ALTER TABLE server_profiles ADD COLUMN tls_ca_cert TEXT NOT NULL DEFAULT ''"},
+		{"tls_ca_path", "ALTER TABLE server_profiles ADD COLUMN tls_ca_path TEXT NOT NULL DEFAULT ''"},
+		{"tls_insecure", "ALTER TABLE server_profiles ADD COLUMN tls_insecure INTEGER NOT NULL DEFAULT 0"},
+		{"tls_pinned_hash", "ALTER TABLE server_profiles ADD COLUMN tls_pinned_hash TEXT NOT NULL DEFAULT ''"},
+	}
+	for _, c := range cols {
+		if !columnExists(s.db, "server_profiles", c.name) {
+			if _, err := s.db.Exec(c.sql); err != nil {
+				return fmt.Errorf("migrate v4 add %s: %w", c.name, err)
+			}
+		}
+	}
+	return nil
+}
+
 // columnExists reports whether a column exists on a table.
 func columnExists(db *sql.DB, table, column string) bool {
 	rows, err := db.Query(fmt.Sprintf("PRAGMA table_info(%s)", table))

internal/db/profile.go

@@ -14,11 +14,13 @@ func (s *Store) CreateProfile(p *model.ServerProfile) (int64, error) {
 		`INSERT INTO server_profiles
 		   (name, protocol, host, server_ips, port, path,
 		    username, auth_mode, routing_mode,
-		    custom_cidrs, mtu_override, auto_connect)
-		 VALUES (?,?,?,?,?,?,?,?,?,?,?,?)`,
+		    custom_cidrs, mtu_override, auto_connect,
+		    tls_ca_cert, tls_ca_path, tls_insecure, tls_pinned_hash)
+		 VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)`,
 		p.Name, p.Protocol, p.Host, p.ServerIPs, p.Port, p.Path,
 		p.Username, p.AuthMode, p.RoutingMode,
 		p.CustomCIDRs, p.MTUOverride, p.AutoConnect,
+		p.TLSCACert, p.TLSCAPath, p.TLSInsecure, p.TLSPinnedHash,
 	)
 	if err != nil {
 		return 0, fmt.Errorf("insert profile: %w", err)
@@ -36,11 +38,14 @@ func (s *Store) GetProfile(id int64) (*model.ServerProfile, error) {
 	err := s.db.QueryRow(
 		`SELECT id, name, protocol, host, server_ips, port, path,
 		        username, auth_mode, routing_mode,
-		        custom_cidrs, mtu_override, auto_connect, created_at, last_connected_at
+		        custom_cidrs, mtu_override, auto_connect,
+		        tls_ca_cert, tls_ca_path, tls_insecure, tls_pinned_hash,
+		        created_at, last_connected_at
 		 FROM server_profiles WHERE id = ?`, id,
 	).Scan(&p.ID, &p.Name, &p.Protocol, &p.Host, &p.ServerIPs, &p.Port, &p.Path,
 		&p.Username, &p.AuthMode, &p.RoutingMode, &p.CustomCIDRs, &p.MTUOverride,
-		&p.AutoConnect, &p.CreatedAt, &last)
+		&p.AutoConnect, &p.TLSCACert, &p.TLSCAPath, &p.TLSInsecure, &p.TLSPinnedHash,
+		&p.CreatedAt, &last)
 	if err != nil {
 		return nil, fmt.Errorf("get profile %d: %w", id, err)
 	}
@@ -55,7 +60,9 @@ func (s *Store) ListProfiles() ([]model.ServerProfile, error) {
 	rows, err := s.db.Query(
 		`SELECT id, name, protocol, host, server_ips, port, path,
 		        username, auth_mode, routing_mode,
-		        custom_cidrs, mtu_override, auto_connect, created_at, last_connected_at
+		        custom_cidrs, mtu_override, auto_connect,
+		        tls_ca_cert, tls_ca_path, tls_insecure, tls_pinned_hash,
+		        created_at, last_connected_at
 		 FROM server_profiles ORDER BY name`)
 	if err != nil {
 		return nil, fmt.Errorf("list profiles: %w", err)
@@ -68,7 +75,9 @@ func (s *Store) ListProfiles() ([]model.ServerProfile, error) {
 		var last sql.NullTime
 		if err := rows.Scan(&p.ID, &p.Name, &p.Protocol, &p.Host, &p.ServerIPs,
 			&p.Port, &p.Path, &p.Username, &p.AuthMode, &p.RoutingMode,
-			&p.CustomCIDRs, &p.MTUOverride, &p.AutoConnect, &p.CreatedAt, &last); err != nil {
+			&p.CustomCIDRs, &p.MTUOverride, &p.AutoConnect,
+			&p.TLSCACert, &p.TLSCAPath, &p.TLSInsecure, &p.TLSPinnedHash,
+			&p.CreatedAt, &last); err != nil {
 			return nil, err
 		}
 		if last.Valid {
@@ -85,11 +94,13 @@ func (s *Store) UpdateProfile(p *model.ServerProfile) error {
 		`UPDATE server_profiles SET
 		    name = ?, protocol = ?, host = ?, server_ips = ?, port = ?, path = ?,
 		    username = ?, auth_mode = ?, routing_mode = ?,
-		    custom_cidrs = ?, mtu_override = ?, auto_connect = ?
+		    custom_cidrs = ?, mtu_override = ?, auto_connect = ?,
+		    tls_ca_cert = ?, tls_ca_path = ?, tls_insecure = ?, tls_pinned_hash = ?
 		 WHERE id = ?`,
 		p.Name, p.Protocol, p.Host, p.ServerIPs, p.Port, p.Path,
 		p.Username, p.AuthMode, p.RoutingMode,
-		p.CustomCIDRs, p.MTUOverride, p.AutoConnect, p.ID)
+		p.CustomCIDRs, p.MTUOverride, p.AutoConnect,
+		p.TLSCACert, p.TLSCAPath, p.TLSInsecure, p.TLSPinnedHash, p.ID)
 	if err != nil {
 		return fmt.Errorf("update profile %d: %w", p.ID, err)
 	}