feat(simnet): add SimNet protocol end-to-end support

- model: SimNet protocol fields + NormalizeSimnet; type+port protocol uniqueness
- server config: OmnXT runtime config delivery via compatible() simnet case
- credentials: derive per-user psk/key_id from subscription (pkg/simnet), no new table
- subscription: adapter buildOmnxtSimnetConfigs + base64 buildOmnxtProtocolLinks + OmnXT SimNet application (migration 02161)
- UA gating: hide experimental protocols from non first-party clients (download + JSON node-list)
- admin: normalize simnet on create/update and on GET responses
- tests: 21 simnet unit tests; full suite green

adapter/client.go

@@ -81,10 +81,38 @@ type Proxy struct {
 	CertMode        string  // Certificate mode, `none`｜`http`｜`dns`｜`self`
 	CertDNSProvider string  // DNS provider for certificate
 	CertDNSEnv      string  // Environment for DNS provider
+
+	// Simnet Options (server-side config; per-user psk/key_id are derived at
+	// render time from UserInfo, never stored on the Proxy).
+	SimnetPsk                          string // server-side PSK (key_id=0), used for AF derivation
+	SimnetKeyID                        int    // server key id (0)
+	SimnetTicketID                     string
+	SimnetPath                         string
+	SimnetCarrier                      string
+	SimnetAfEnabled                    bool
+	SimnetAfPathMode                   string
+	SimnetAfPathPrefix                 string
+	SimnetAfPathSuffix                 string
+	SimnetAfMagicMode                  string
+	SimnetAfResponseJitterMs           int
+	SimnetAfHandshakePolymorphism      bool
+	SimnetAfSettingsJitter             bool
+	SimnetAfFakeHeaderInjection        bool
+	SimnetFallbackEnabled              bool
+	SimnetFallbackTargetScheme         string
+	SimnetFallbackTargetHost           string
+	SimnetFallbackTargetPort           int
+	SimnetFallbackHostHeader           string
+	SimnetFallbackTLSSNI               string
+	SimnetClientMaxConcurrentStreams   int
+	SimnetClientMaxStreamsPerSession   int
+	SimnetClientSessionIdleTimeoutSecs int
+	SimnetClientMaxUDPSessions         int
 }
 
 type User struct {
 	Password     string
+	SubscribeID  int64 // user_subscribe.id — derives the simnet per-user key_id
 	ExpiredAt    time.Time
 	Download     int64
 	Upload       int64
@@ -104,7 +132,10 @@ type Client struct {
 
 func (c *Client) Build() ([]byte, error) {
 	var buf bytes.Buffer
-	tmpl, err := template.New("client").Funcs(sprig.TxtFuncMap()).Parse(c.ClientTemplate)
+	funcMap := sprig.TxtFuncMap()
+	funcMap["buildOmnxtSimnetConfigs"] = buildOmnxtSimnetConfigs
+	funcMap["buildOmnxtProtocolLinks"] = buildOmnxtProtocolLinks
+	tmpl, err := template.New("client").Funcs(funcMap).Parse(c.ClientTemplate)
 	if err != nil {
 		return nil, err
 	}