tsk_9uMrd9kUpmVA: 数据面定稿 + 修订 ARCHITECTURE.md connect 契约

决策：libbox 统一承载 REALITY/Hy2 outbound（方案 C），弃用 WireGuard peer 注册。
现网 deploy/ 基础设施（singbox Hy2 + xray REALITY）已验证，零改动复用。

变更文件：
- design/server/ARCHITECTURE.md v0.2：
  · §0 数据面描述改为 sing-box libbox (REALITY/Hy2)
  · §1 拓扑图更新（wireguard+agent → singbox+agent，客户端标注 libbox 内嵌）
  · §2 devices 表移除 pubkey；nodes 表改为 reality_public_key/short_id/uuid/hy2_password
  · §3 connect 响应由 WireGuard 配置改为完整 sing-box config JSON
  · §3.1（新增）connect 契约详细规范：四块 inbounds/outbounds/route/dns、
    客户端透传原则、字段与 deploy/ 模板逐字段对照、占位符替换说明
  · §4.3 连接流程更新（peer 注册 → config JSON 渲染下发）
  · 附录 A（新增）v0.1→v0.2 变更汇总
- doc/plans/11-libbox-bridge.md（新建）：
  完整决策记录（背景/备选/结论/影响面），任务链 11A→11C→11D/E/F→11H
- doc/plans/client-connect-config.example.json（新建）：
  最小示例 config，字段与 deploy/ 模板对齐，可用 sing-box check -c 校验

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

doc/plans/client-connect-config.example.json

@@ -0,0 +1,99 @@
+{
+  "log": {
+    "level": "warn",
+    "timestamp": true
+  },
+  "inbounds": [
+    {
+      "type": "tun",
+      "tag": "tun-in",
+      "address": ["172.19.0.1/30"],
+      "mtu": 9000,
+      "auto_route": true,
+      "strict_route": true,
+      "stack": "system"
+    }
+  ],
+  "outbounds": [
+    {
+      "type": "vless",
+      "tag": "reality-out",
+      "server": "__NODE_HOST__",
+      "server_port": 11443,
+      "uuid": "ffffffff-ffff-ffff-ffff-ffffffffffff",
+      "flow": "xtls-rprx-vision",
+      "tls": {
+        "enabled": true,
+        "server_name": "www.apple.com",
+        "utls": {
+          "enabled": true,
+          "fingerprint": "chrome"
+        },
+        "reality": {
+          "enabled": true,
+          "public_key": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "short_id": "deadbeef"
+        }
+      }
+    },
+    {
+      "type": "hysteria2",
+      "tag": "hy2-out",
+      "server": "__NODE_HOST__",
+      "server_port": 443,
+      "password": "__HY2_PASSWORD__",
+      "tls": {
+        "enabled": true,
+        "insecure": true,
+        "alpn": ["h3"]
+      }
+    },
+    {
+      "type": "urltest",
+      "tag": "auto",
+      "outbounds": ["reality-out", "hy2-out"],
+      "url": "https://www.gstatic.com/generate_204",
+      "interval": "3m",
+      "tolerance": 50
+    },
+    {
+      "type": "block",
+      "tag": "block"
+    },
+    {
+      "type": "direct",
+      "tag": "direct"
+    }
+  ],
+  "route": {
+    "rules": [
+      {
+        "ip_cidr": [
+          "10.0.0.0/8",
+          "172.16.0.0/12",
+          "192.168.0.0/16",
+          "127.0.0.0/8"
+        ],
+        "outbound": "direct"
+      }
+    ],
+    "final": "auto",
+    "auto_detect_interface": true
+  },
+  "dns": {
+    "servers": [
+      {
+        "tag": "remote",
+        "address": "tls://8.8.8.8",
+        "detour": "auto"
+      },
+      {
+        "tag": "local",
+        "address": "223.5.5.5",
+        "detour": "direct"
+      }
+    ],
+    "final": "remote",
+    "strategy": "ipv4_only"
+  }
+}