feat(backend): 挂载 /v1 API + 实现 nodes/connect 端到端

- 新增 internal/dpcred 包，统一 DeriveHy2Password + DefaultFlow
  agentd 与 HTTP connect handler 共享同一实现
- 新增迁移 000011：nodes 表拆分 reality_prk 私钥 / reality_pbk 公钥
  reality_short_id；修正 handler_grpc.go 使用私钥字段
- 新增迁移 000012：connect_credentials 持久化凭证
  实现 CredentialsForNode 修复 agent 重连 resync 原先返回空的桩
- 扩展 NodeStore 接口：ListUp / EntitlementForUser /
  PersistCredential / DeleteCredential；同步 grpc_test.go mock
- 新增 httpapi/nodes.go：GET /nodes、POST /nodes/id/connect
  Hub.Push + PersistCredential + 渲染完整 sing-box client 配置 JSON
  POST /nodes/id/disconnect
- 新增 httpapi/account.go：GET /me、GET /plans、GET /notices
- 新增 httpapi/clientconfig.go：BuildClientConfig 服务端渲染
- 重写 cmd/server/main.go：手写 chi public/protected 分组
  nodes.Service/Hub 在 main 构造并共享；SMTPMailer/LogMailer

go build ./... && go vet ./... && go test ./... 全部通过

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/migrations/000011_node_reality_private.down.sql

@@ -0,0 +1,3 @@
+ALTER TABLE nodes
+  DROP COLUMN reality_short_id,
+  DROP COLUMN reality_prk;

server/migrations/000011_node_reality_private.up.sql

@@ -0,0 +1,10 @@
+-- Add reality_prk to store the REALITY private key on the node row.
+-- Previously reality_pbk was overloaded to hold the private key (which the
+-- agent needs for its inbound); this migration separates concerns:
+--   reality_pbk  = REALITY x25519 PUBLIC key  (used in client connect config)
+--   reality_prk  = REALITY x25519 PRIVATE key (used by the agent for its inbound TLS)
+-- Existing rows: reality_pbk continues to hold whatever was there until the
+-- operator seeds / updates the node row via nodectl or direct SQL.
+ALTER TABLE nodes
+  ADD COLUMN reality_prk VARCHAR(64) NOT NULL DEFAULT '' AFTER reality_pbk,
+  ADD COLUMN reality_short_id VARCHAR(16) NOT NULL DEFAULT '' AFTER reality_prk;

server/migrations/000012_connect_credentials.down.sql

@@ -0,0 +1 @@
+DROP TABLE IF EXISTS connect_credentials;

server/migrations/000012_connect_credentials.up.sql

@@ -0,0 +1,15 @@
+-- Persist active connect credentials so the agent can replay them on reconnect.
+-- Without this table, an agent restart drops all active user tunnels until each
+-- user reconnects.  The connect handler writes here; disconnect deletes; the
+-- gRPC Register handler calls CredentialsForNode to replay on full resync.
+CREATE TABLE connect_credentials (
+  node_id     BIGINT UNSIGNED NOT NULL,
+  dp_uuid     CHAR(36) NOT NULL,
+  protocol    TINYINT NOT NULL DEFAULT 3,     -- agentv1.ProtocolBoth = 3
+  flow        VARCHAR(64) NOT NULL DEFAULT 'xtls-rprx-vision',
+  expires_at  DATETIME(6) NOT NULL,
+  created_at  DATETIME(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+  PRIMARY KEY (node_id, dp_uuid),
+  INDEX idx_node_expires (node_id, expires_at),
+  CONSTRAINT fk_cc_node FOREIGN KEY (node_id) REFERENCES nodes(id) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;