feat(egress): support Clash subscriptions and Reality Vision

[MMortise]

Summary

• fetch proxy subscriptions with a Clash-compatible User-Agent and parse top-level proxies from Clash YAML
• convert HTTP, SOCKS5, Trojan, VLESS, Shadowsocks, and VMess entries into the existing canonical proxy format
• support VLESS Reality with xtls-rprx-vision, including the VLESS flow addon and Vision data framing
• honor Chrome, Edge, Safari, Firefox, iOS, and QQ ClientHello fingerprints, preserve explicit ALPN, and reject presets without an X25519 TLS 1.3 key share
• retain subscription SSRF restrictions and canonical duplicate removal

Supported variants

• Trojan, VLESS, Shadowsocks, and VMess subscription nodes
• TCP and WebSocket transports already supported by the embedded dialers
• VLESS Reality and xtls-rprx-vision
• Clash HTTP and SOCKS5 entries

Deferred

Hysteria and TUIC are intentionally not implemented in this PR. Clash entries using those protocols remain skipped during subscription import.

Verification

• cd backend && go test ./...
• cd backend && go test -race ./internal/application/egress ./internal/pkg/tunnelproxy
• cd backend && go vet ./internal/application/egress ./internal/pkg/tunnelproxy
• git diff --check upstream/main..HEAD
• live wcloud subscription: parsed all 41 VLESS Reality entries into 38 unique dialers; the remaining three differ only by display name
• live HTTPS tunnel requests succeeded through Chrome, Edge, and Safari Reality/Vision nodes