feat(single-node): 改 SQLite + 非特权 pangolin 用户 + 免 Docker(512MB 可跑)

为小内存机收尾单机栈,已在 racknerd(107.172.55.251)实跑验证通过:
- 数据库:MySQL(docker)→ SQLite 文件(DB_DRIVER=sqlite);Redis 改 apt 原生
  (免 Docker);依赖 redis-server/sqlite3/polkitd/sing-box 由 deploy.sh 自动装
- 运行身份:三 systemd 单元 User=root → User=pangolin;sing-box 经
  AmbientCapabilities 绑 443;新增 polkit 规则让 pangolin 仅可重启 sing-box
- 二进制:支持预置(机上无 go 时用交叉编译产物;SQLite 纯 Go 免 CGO)
- 端口:REALITY 默认 443/tcp(对齐 bootstrap 防火墙);deploy.sh 放行 8080/tcp
- 修 sing-box.service:ExecStart 按实际安装路径渲染(官方 .deb 在 /usr/bin)
- Hy2 默认关闭:控制面尚未下发 Hy2 TLS 证书(handler_grpc.go 仅发 ListenPort)
  → 开启会 missing certificate;待补全证书后传 HY2_PORT=443 开启
- 删 docker-compose.yml;seed TRUE→1;README 同步

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deploy/single-node/seed-node.sql.tmpl

@@ -11,7 +11,7 @@ DELETE FROM nodes     WHERE uuid = '__NODE_UUID__';
 DELETE FROM providers WHERE name = 'single-node';
 
 INSERT INTO providers (name, api_kind, regions, pool, enabled)
-VALUES ('single-node', 'manual', '["__REGION__"]', 'consumable', TRUE);
+VALUES ('single-node', 'manual', '["__REGION__"]', 'consumable', 1);
 
 INSERT INTO nodes
   (uuid, region, name_zh, name_en, role, tier, endpoint, hy2_port,