feat: 添加服务端证书合法性验证（自定义CA/跳过验证/证书固定）

- 新增 internal/tlsconfig 包，集中构建 TLS 配置
- 修复 CDN 边缘 IP 故障转移时 HTTP 登录 TLS 验证失败的问题
- 支持自定义 CA 证书（内联 PEM + 文件路径，合并生效）
- 支持 InsecureSkipVerify 跳过证书验证
- 支持证书固定（SHA-256 指纹校验）
- TLS 验证错误设为不可恢复，避免无限重试
- Profile 编辑界面新增 TLS 设置区域，协议联动启用/禁用
- DB schema v4 迁移，新增 4 个 TLS 字段

internal/i18n/en.toml

@@ -102,3 +102,16 @@ AuthModePassword = "Password"
 RoutingModeFull = "Full Tunnel"
 RoutingModeSplit = "Split Tunnel"
 RoutingModeCustom = "Custom"
+
+FieldTLS = "TLS Certificate"
+FieldTLSCACert = "CA Certificate (PEM)"
+FieldTLSCAPath = "CA Certificate Path"
+HintTLSCAReplacesSystem = "Setting a custom CA replaces system root certificates. Public CA servers (e.g. Let's Encrypt) will fail verification."
+FieldTLSInsecure = "Skip Verification (Insecure)"
+FieldTLSPinnedHash = "Certificate Pin (SHA-256)"
+PlaceholderTLSCACert = "-----BEGIN CERTIFICATE-----..."
+PlaceholderTLSCAPath = "/path/to/ca.crt"
+PlaceholderTLSPinnedHash = "sha256:a1b2c3..."
+BtnBrowse = "Browse..."
+DlgTLSError = "TLS Certificate Error"
+TLSErrorVerification = "Server certificate verification failed."

internal/i18n/zh-Hans.toml

@@ -102,3 +102,16 @@ AuthModePassword = "密码"
 RoutingModeFull = "全隧道"
 RoutingModeSplit = "分离隧道"
 RoutingModeCustom = "自定义"
+
+FieldTLS = "TLS 证书"
+FieldTLSCACert = "CA 证书 (PEM)"
+FieldTLSCAPath = "CA 证书路径"
+HintTLSCAReplacesSystem = "设置自定义 CA 将替换系统根证书，使用公共 CA（如 Let's Encrypt）的服务器将验证失败。"
+FieldTLSInsecure = "跳过验证 (不安全)"
+FieldTLSPinnedHash = "证书固定 (SHA-256)"
+PlaceholderTLSCACert = "-----BEGIN CERTIFICATE-----..."
+PlaceholderTLSCAPath = "/path/to/ca.crt"
+PlaceholderTLSPinnedHash = "sha256:a1b2c3..."
+BtnBrowse = "浏览..."
+DlgTLSError = "TLS 证书错误"
+TLSErrorVerification = "服务器证书验证失败。"