Harden proxy failover and deployment defaults

[mtmtian]

What changed

• Add default fallback proxy group and optional CDN-only mode.
• Add optional Hysteria2 port hopping, Salamander obfuscation, and Cloudflare DNS-01 certificates.
• Pin server component versions and validate Xray configuration before restart.
• Update provider firewall/service handling and add generator coverage.

Impact

• Default mode remains direct Reality/Hysteria2/AnyTLS (CDN_ONLY=false); existing imported client configs are unchanged until regenerated and re-imported.
• CDN-only is opt-in and removes direct protocol capability after deployment.
• Optional Hysteria2 features are disabled by default.

Validation

• python3 -m unittest discover -s tests -p 'test_*.py' -v — 50 passed, 1 skipped because Mihomo is not installed locally.
• bash -n deploy.sh deploy-gcp.sh deploy-vps.sh core/*.sh providers/*.sh
• git diff --check
• Generated YAML parsed successfully with Ruby YAML.

Deployment note

The attempted frantech VPS rollout was blocked before remote execution because SSH banner negotiation timed out at 198.98.61.198:22; TCP port 22 was reachable. No remote service changes were made.