Merge branch 'main' into feat/configurable-proxy

# Conflicts:
#	.gitignore
#	client/lib/l10n/strings_es.dart
#	client/lib/l10n/strings_ja.dart
#	client/lib/l10n/strings_ko.dart
#	client/lib/l10n/strings_ru.dart
#	docs/index.html
#	scripts/local_test.sh

server/cmd/agent/main.go

@@ -44,6 +44,23 @@ func main() {
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 	defer stop()
 
+	// SIGHUP 重读节点本地配置(acl.json / warp.json)并重渲染。走 sing-box 的 SIGHUP
+	// 热重载路径,在线用户不掉线;重启 agent 则会冷启 sing-box,把所有人踢下线。
+	hup := make(chan os.Signal, 1)
+	signal.Notify(hup, syscall.SIGHUP)
+	defer signal.Stop(hup)
+	go func() {
+		for {
+			select {
+			case <-ctx.Done():
+				return
+			case <-hup:
+				log.Printf("[pangolin-agent] SIGHUP: re-reading node-local config (acl.json/warp.json)")
+				agent.SingBox().Refresh()
+			}
+		}
+	}()
+
 	log.Printf("[pangolin-agent] starting (control-plane=%s, version=%s)", cfg.ControlPlaneAddr, cfg.AgentVersion)
 	start := time.Now()
 	if err := agent.Run(ctx); err != nil {

server/cmd/server/main.go

@@ -419,7 +419,15 @@ func mountV1(r chi.Router, sqlDB *sql.DB, rdb *redis.Client, nodeSvc *nodes.Serv
 			slog.Warn("PANGOLIN_PUBLIC_URL 未设置:国内分流(split_cn)将被静默跳过,客户端全量走隧道。" +
 				"如需国内直连,设为控制面对外公网基址(如 http://<公网IP>:8080)")
 		}
-		nodeAPI = httpapi.NewNodeAPI(nodeStore, nodeSvc.Hub(), nodeSvc.Load(), os.Getenv("NODE_DERIVE_KEY"), publicURL)
+		// 私有服务域名分流(家庭内网穿透,如 nas/git/win.yanmeiai.com):
+		// 逗号分隔;这些域名用系统 DNS 解析、在外强制走隧道(排在国内分流前)。
+		var privateSplitDomains []string
+		for _, d := range strings.Split(os.Getenv("PANGOLIN_PRIVATE_SPLIT_DOMAINS"), ",") {
+			if d = strings.TrimSpace(d); d != "" {
+				privateSplitDomains = append(privateSplitDomains, d)
+			}
+		}
+		nodeAPI = httpapi.NewNodeAPI(nodeStore, nodeSvc.Hub(), nodeSvc.Load(), os.Getenv("NODE_DERIVE_KEY"), publicURL, privateSplitDomains)
 	}
 
 	// 国内分流(#5)的 rule-set 静态服务:GET /v1/rules/{name}.srs(自托管,