chore: 初始提交 Fonu 1.0.2

- 公网反代：Nginx 状态卡片（版本 / 运行状态 / 配置校验 / 端口监听）
- 部署设置第一、二梯队（HTTPS 开关、安全头、限流、连接数、仅中国大陆 IP）
- 隧道检测兼容 frps v0.68 / v0.71（V2 与旧版端点）
- 恢复被清空的 internal/frp/store.go、internal/api/ddns_handler.go、web/src/views/DdnsView.vue

internal/acme/zerossl.go

@@ -0,0 +1,62 @@
+package acme
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+	"time"
+)
+
+type zeroSSLEABResponse struct {
+	Success    int    `json:"success"`
+	EABKid     string `json:"eab_kid"`
+	EABHmacKey string `json:"eab_hmac_key"`
+	Error      struct {
+		Code int    `json:"code"`
+		Type string `json:"type"`
+	} `json:"error"`
+}
+
+func zerosslEABCredentials(ctx context.Context, apiKey string) (kid, hmac string, err error) {
+	apiKey = strings.TrimSpace(apiKey)
+	if apiKey == "" {
+		return "", "", fmt.Errorf("请在设置中配置 ZeroSSL API Key")
+	}
+
+	endpoint := "https://api.zerossl.com/acme/eab-credentials?access_key=" + url.QueryEscape(apiKey)
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
+	if err != nil {
+		return "", "", err
+	}
+
+	client := &http.Client{Timeout: 30 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return "", "", fmt.Errorf("请求 ZeroSSL API 失败：%w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
+	if err != nil {
+		return "", "", err
+	}
+	if resp.StatusCode != http.StatusOK {
+		return "", "", fmt.Errorf("ZeroSSL API 返回 %d", resp.StatusCode)
+	}
+
+	var payload zeroSSLEABResponse
+	if err := json.Unmarshal(body, &payload); err != nil {
+		return "", "", fmt.Errorf("解析 ZeroSSL 响应失败：%w", err)
+	}
+	if payload.Success != 1 || payload.EABKid == "" || payload.EABHmacKey == "" {
+		if payload.Error.Type != "" {
+			return "", "", fmt.Errorf("ZeroSSL API 错误：%s", payload.Error.Type)
+		}
+		return "", "", fmt.Errorf("ZeroSSL API 未返回有效的 EAB 凭据")
+	}
+	return payload.EABKid, payload.EABHmacKey, nil
+}