添加 WebSocket VPN 接口及用户认证

- 移动 config 包到 internal/config，新增 DatabaseConfig
- 使用 GORM + SQLite 管理用户数据，预留 MySQL 支持
- 新增 internal/model/user.go GORM 用户模型
- 新增 internal/db/db.go 数据库初始化及默认管理员
- 新增 internal/vpn/ WebSocket 鉴权与隧道骨架
- /ws 路径支持用户名+密码鉴权 (bcrypt)
- 心跳保活 + echo 隧道模式

internal/vpn/auth.go

@@ -0,0 +1,65 @@
+package vpn
+
+import (
+	"encoding/json"
+
+	"lmvpn/internal/model"
+
+	"github.com/gorilla/websocket"
+	"golang.org/x/crypto/bcrypt"
+	"gorm.io/gorm"
+)
+
+type authMessage struct {
+	Type     string `json:"type"`
+	Username string `json:"username"`
+	Password string `json:"password"`
+}
+
+type authResponse struct {
+	Type    string `json:"type"`
+	Message string `json:"message,omitempty"`
+}
+
+func authenticate(conn *websocket.Conn, db *gorm.DB) (*model.User, error) {
+	_, msgBytes, err := conn.ReadMessage()
+	if err != nil {
+		return nil, err
+	}
+
+	var msg authMessage
+	if err := json.Unmarshal(msgBytes, &msg); err != nil || msg.Type != "auth" {
+		resp := authResponse{Type: "auth_err", Message: "消息格式错误"}
+		sendJSON(conn, resp)
+		conn.Close()
+		return nil, nil
+	}
+
+	var user model.User
+	if err := db.Where("username = ? AND status = 1", msg.Username).First(&user).Error; err != nil {
+		resp := authResponse{Type: "auth_err", Message: "用户名或密码错误"}
+		sendJSON(conn, resp)
+		conn.Close()
+		return nil, nil
+	}
+
+	if err := bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(msg.Password)); err != nil {
+		resp := authResponse{Type: "auth_err", Message: "用户名或密码错误"}
+		sendJSON(conn, resp)
+		conn.Close()
+		return nil, nil
+	}
+
+	resp := authResponse{Type: "auth_ok"}
+	if err := sendJSON(conn, resp); err != nil {
+		conn.Close()
+		return nil, nil
+	}
+
+	return &user, nil
+}
+
+func sendJSON(conn *websocket.Conn, v interface{}) error {
+	data, _ := json.Marshal(v)
+	return conn.WriteMessage(websocket.TextMessage, data)
+}