feat: VPN 管理后台新增系统环境检测面板

- 新增 /api/admin/vpn/diag 端点，检测 TUN 创建能力、root、CAP_NET_ADMIN、ip_forward、MASQUERADE
- Linux 下解析 /proc/self/status CapEff 位判断 CAP_NET_ADMIN，读 /proc/sys/net/ipv4/ip_forward，执行 iptables 检查 MASQUERADE
- 非 Linux 平台显示"仅 Linux 适用"
- 前端 VpnView 新增系统环境检测卡片，每项以勾叉标识并附修复提示

internal/vpn/diag.go

@@ -0,0 +1,52 @@
+package vpn
+
+import (
+	"os"
+	"runtime"
+)
+
+type DiagResult struct {
+	Platform        string `json:"platform"`
+	IsRoot          bool   `json:"is_root"`
+	HasCapNetAdmin  *bool  `json:"has_cap_net_admin"`
+	CapNetAdminNote string `json:"cap_net_admin_note,omitempty"`
+	IPForward       *bool  `json:"ip_forward"`
+	IPForwardNote   string `json:"ip_forward_note,omitempty"`
+	Masquerade      *bool  `json:"masquerade"`
+	MasqueradeNote  string `json:"masquerade_note,omitempty"`
+	TUNCreate       string `json:"tun_create"`
+	TUNRunning      bool   `json:"tun_running"`
+	TUNName         string `json:"tun_name,omitempty"`
+}
+
+func Diag(svc *VpnService) DiagResult {
+	r := DiagResult{Platform: runtime.GOOS, IsRoot: os.Getuid() == 0}
+
+	if svc != nil {
+		svc.mu.RLock()
+		r.TUNRunning = svc.running
+		if svc.tun != nil {
+			r.TUNName = svc.tun.Name()
+		}
+		svc.mu.RUnlock()
+	}
+
+	if r.TUNRunning {
+		r.TUNCreate = "ok: " + r.TUNName
+	} else {
+		r.TUNCreate = testTUNCreate()
+	}
+
+	fillPlatformDiag(&r)
+	return r
+}
+
+func testTUNCreate() string {
+	t, err := CreateTUN("")
+	if err != nil {
+		return "fail: " + err.Error()
+	}
+	name := t.Name()
+	_ = t.Close()
+	return "ok: " + name
+}

internal/vpn/diag_linux.go

@@ -0,0 +1,74 @@
+//go:build linux
+
+package vpn
+
+import (
+	"os"
+	"os/exec"
+	"strconv"
+	"strings"
+)
+
+func fillPlatformDiag(r *DiagResult) {
+	r.HasCapNetAdmin = ptrBool(checkCapNetAdmin())
+	if r.HasCapNetAdmin == nil || !*r.HasCapNetAdmin {
+		r.CapNetAdminNote = "CAP_NET_ADMIN 未授权，TUN 操作需 root 或显式授予该能力"
+	}
+
+	v := readIPForward()
+	r.IPForward = v
+	if v == nil || !*v {
+		r.IPForwardNote = "未开启，执行: sysctl -w net.ipv4.ip_forward=1"
+	}
+
+	m := checkMasquerade()
+	r.Masquerade = m
+	if m == nil {
+		r.MasqueradeNote = "iptables 未安装或不可执行"
+	} else if !*m {
+		r.MasqueradeNote = "未检测到 MASQUERADE 规则，客户端无法出网"
+	}
+}
+
+func ptrBool(b bool) *bool { return &b }
+
+func checkCapNetAdmin() bool {
+	data, err := os.ReadFile("/proc/self/status")
+	if err != nil {
+		return false
+	}
+	for _, line := range strings.Split(string(data), "\n") {
+		if !strings.HasPrefix(line, "CapEff:") {
+			continue
+		}
+		fields := strings.Fields(line)
+		if len(fields) < 2 {
+			return false
+		}
+		val, err := strconv.ParseUint(fields[1], 16, 64)
+		if err != nil {
+			return false
+		}
+		return val&(1<<12) != 0
+	}
+	return false
+}
+
+func readIPForward() *bool {
+	data, err := os.ReadFile("/proc/sys/net/ipv4/ip_forward")
+	if err != nil {
+		return nil
+	}
+	v := strings.TrimSpace(string(data)) == "1"
+	return &v
+}
+
+func checkMasquerade() *bool {
+	cmd := exec.Command("iptables", "-t", "nat", "-L", "POSTROUTING", "-n")
+	out, err := cmd.Output()
+	if err != nil {
+		return nil
+	}
+	has := strings.Contains(string(out), "MASQUERADE")
+	return &has
+}

internal/vpn/diag_other.go

@@ -0,0 +1,12 @@
+//go:build !linux
+
+package vpn
+
+func fillPlatformDiag(r *DiagResult) {
+	r.HasCapNetAdmin = nil
+	r.CapNetAdminNote = "仅 Linux 适用"
+	r.IPForward = nil
+	r.IPForwardNote = "仅 Linux 适用"
+	r.Masquerade = nil
+	r.MasqueradeNote = "仅 Linux 适用"
+}