feat(agent): node agent — enroll/mTLS, heartbeat, command stream, sing-box 用户表 (tsk__R8M4jEw43JR)

与控制面同仓同 go.mod，新增节点 agent 实现：

- proto/agent/v1/agent.proto + internal/pb/agentv1：冻结的控制面↔agent gRPC 契约
  （Enroll/Register/Heartbeat/Subscribe/Ack/ReportUsage）。仓库尚无 protoc 流水线，
  暂以手写 Go 类型 + JSON gRPC codec 实现，与 proto 1:1 对应，待 protoc 接入即可替换。
- internal/agentd：
  - enroll.go：首启生成 EC 密钥+CSR，持 bootstrap token 调 Enroll 换 90d 节点证书
    （CN=node_uuid），落 /etc/pangolin-agent/，此后 mTLS。
  - conn.go(agent.go)+creds.go：mTLS 主动拨号 + 指数退避重连；重连携带 last_command_id；
    Register 取 ConfigSnapshot 全量配置覆盖本地。
  - heartbeat.go：30s 上报 peer/带宽/CPU + config_version；need_full_resync→全量同步。
  - command.go：消费 Subscribe，Upsert/Revoke/Rotate/ApplyConfig/Lifecycle 幂等处理后
    Ack（at-least-once，按 command_id 去重）。
  - singbox.go+render.go：内存用户表 + 落盘 state.json（仅 dp_uuid+expires_at）；任何变更
    渲染完整 sing-box 配置（REALITY users[uuid,flow] + Hy2 users[派生口令]）→ 500ms 去抖
    合并 → systemd 重启。
  - ttl.go：凭证 TTL 定时移除并上报。
  - usage.go：按 dp_uuid 聚合上报，绝无 user_id/email/目的地址。
  - derive.go：Hy2 口令 = HMAC-SHA256(key, dp_uuid)，与控制面同源派生。
- cmd/agent：入口（flag/env 配置）。
- infra/cloud-init/{node.yaml.tmpl,install-node.sh,README.md}：一段式安装，下载锁定版本
  二进制并校验 SHA-256，systemd 拉管，首启即 Enroll/Register。shellcheck -S warning 通过。

测试（bufconn mock 控制面，无需 docker）：Enroll→Register→Heartbeat 全流转；Upsert/Revoke
渲染正确；Rotate 宽限期新旧并存到点移除；TTL 自动移除并上报；断流重连 last_command_id
续发不丢不重；need_full_resync 触发重注册；state.json 恢复；去抖合并；扫描确认无身份字段。
go test -race ./internal/agentd/... ./internal/pb/... 通过；go vet ./... 通过。

落实 doc/04 §2 节点无状态化与 doc/06 §3 数据面红线（节点仅见 dp_uuid）。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/internal/agentd/enroll.go

@@ -0,0 +1,139 @@
+package agentd
+
+import (
+	"context"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+
+	agentv1 "github.com/wangjia/pangolin/server/internal/pb/agentv1"
+	"google.golang.org/grpc"
+)
+
+// EnrollDialer opens a connection suitable for the (un-authenticated) Enroll RPC.
+// The agent has no client certificate yet, so this connection presents none; the
+// bootstrap token authenticates the call instead.
+type EnrollDialer func(ctx context.Context) (*grpc.ClientConn, error)
+
+// EnsureEnrolled guarantees the node holds a valid client certificate.
+//
+//   - If node.crt/node.key already exist, it loads and returns the certificate's
+//     CN (the node UUID) without contacting the control plane (idempotent first
+//     start vs. restart).
+//   - Otherwise it generates an EC P-256 key + CSR, calls Enroll with the
+//     bootstrap token, and persists node.key (0600), node.crt and ca.crt.
+//
+// The private key is generated on the node and never leaves it.
+func EnsureEnrolled(ctx context.Context, cfg Config, dial EnrollDialer) (string, error) {
+	cfg = cfg.withDefaults()
+
+	if uuid, ok, err := loadEnrolledUUID(cfg); err != nil {
+		return "", err
+	} else if ok {
+		return uuid, nil
+	}
+
+	if cfg.BootstrapToken == "" {
+		return "", errors.New("agentd: not enrolled and no bootstrap token provided")
+	}
+
+	keyPEM, csrPEM, err := generateKeyAndCSR()
+	if err != nil {
+		return "", err
+	}
+
+	conn, err := dial(ctx)
+	if err != nil {
+		return "", fmt.Errorf("agentd: dial for enroll: %w", err)
+	}
+	defer conn.Close()
+
+	client := agentv1.NewAgentServiceClient(conn)
+	resp, err := client.Enroll(ctx, &agentv1.EnrollRequest{
+		BootstrapToken: cfg.BootstrapToken,
+		CSRPEM:         csrPEM,
+		AgentVersion:   cfg.AgentVersion,
+	})
+	if err != nil {
+		return "", fmt.Errorf("agentd: enroll rpc: %w", err)
+	}
+	if resp.NodeUUID == "" || len(resp.CertPEM) == 0 {
+		return "", errors.New("agentd: enroll response missing node_uuid/cert")
+	}
+
+	if err := os.MkdirAll(cfg.StateDir, 0o700); err != nil {
+		return "", fmt.Errorf("agentd: mkdir state dir: %w", err)
+	}
+	if err := atomicWrite(cfg.KeyPath(), keyPEM, 0o600); err != nil {
+		return "", err
+	}
+	if err := atomicWrite(cfg.CertPath(), resp.CertPEM, 0o644); err != nil {
+		return "", err
+	}
+	if len(resp.CAPEM) > 0 {
+		if err := atomicWrite(cfg.CAPath(), resp.CAPEM, 0o644); err != nil {
+			return "", err
+		}
+	}
+	logf("enrolled successfully (cert valid until unix=%d)", resp.NotAfterUnix)
+	return resp.NodeUUID, nil
+}
+
+// loadEnrolledUUID returns the CN of the persisted node certificate, if present.
+func loadEnrolledUUID(cfg Config) (string, bool, error) {
+	certPEM, err := os.ReadFile(cfg.CertPath())
+	if errors.Is(err, fs.ErrNotExist) {
+		return "", false, nil
+	}
+	if err != nil {
+		return "", false, fmt.Errorf("agentd: read node cert: %w", err)
+	}
+	if _, err := os.Stat(cfg.KeyPath()); err != nil {
+		// Cert without key is unusable — treat as not enrolled.
+		return "", false, nil
+	}
+	block, _ := pem.Decode(certPEM)
+	if block == nil {
+		return "", false, errors.New("agentd: node cert has no PEM block")
+	}
+	cert, err := x509.ParseCertificate(block.Bytes)
+	if err != nil {
+		return "", false, fmt.Errorf("agentd: parse node cert: %w", err)
+	}
+	if cert.Subject.CommonName == "" {
+		return "", false, errors.New("agentd: node cert has empty CN")
+	}
+	return cert.Subject.CommonName, true, nil
+}
+
+// generateKeyAndCSR creates an EC P-256 private key and a PKCS#10 CSR. The CSR's
+// CN is a placeholder; the CA overrides it with the authoritative node UUID.
+func generateKeyAndCSR() (keyPEM, csrPEM []byte, err error) {
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		return nil, nil, fmt.Errorf("agentd: generate key: %w", err)
+	}
+	keyDER, err := x509.MarshalECPrivateKey(key)
+	if err != nil {
+		return nil, nil, fmt.Errorf("agentd: marshal key: %w", err)
+	}
+	keyPEM = pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: keyDER})
+
+	tmpl := &x509.CertificateRequest{
+		Subject:            pkix.Name{CommonName: "pangolin-node-pending"},
+		SignatureAlgorithm: x509.ECDSAWithSHA256,
+	}
+	csrDER, err := x509.CreateCertificateRequest(rand.Reader, tmpl, key)
+	if err != nil {
+		return nil, nil, fmt.Errorf("agentd: create CSR: %w", err)
+	}
+	csrPEM = pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE REQUEST", Bytes: csrDER})
+	return keyPEM, csrPEM, nil
+}