chore: 初始提交 Fonu 1.0.2

- 公网反代：Nginx 状态卡片（版本 / 运行状态 / 配置校验 / 端口监听）
- 部署设置第一、二梯队（HTTPS 开关、安全头、限流、连接数、仅中国大陆 IP）
- 隧道检测兼容 frps v0.68 / v0.71（V2 与旧版端点）
- 恢复被清空的 internal/frp/store.go、internal/api/ddns_handler.go、web/src/views/DdnsView.vue

internal/nginx/htpasswd.go

@@ -0,0 +1,70 @@
+package nginx
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/fonu/fonu/internal/config"
+	"github.com/fonu/fonu/internal/proxy"
+)
+
+// nginxHtpasswdHash normalizes bcrypt hashes for nginx/apr auth_basic.
+// Go's bcrypt uses the $2a$ prefix; some nginx builds only accept $2y$.
+func nginxHtpasswdHash(hash string) string {
+	if strings.HasPrefix(hash, "$2a$") {
+		return "$2y$" + hash[4:]
+	}
+	return hash
+}
+
+func HtpasswdDir(cfg config.Config) string {
+	return filepath.Join(cfg.NginxDir(), "htpasswd")
+}
+
+func HtpasswdPath(cfg config.Config, ruleID int64) string {
+	return filepath.Join(HtpasswdDir(cfg), fmt.Sprintf("rule_%d.conf", ruleID))
+}
+
+func SyncHtpasswdFiles(cfg config.Config, rules []proxy.Rule) error {
+	dir := HtpasswdDir(cfg)
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		return err
+	}
+	ensureNginxReadable(dir, true)
+
+	active := map[int64]bool{}
+	for _, rule := range rules {
+		path := HtpasswdPath(cfg, rule.ID)
+		if rule.Security.BasicAuthEnabled() {
+			active[rule.ID] = true
+			line := fmt.Sprintf("%s:%s\n", rule.Security.BasicAuth.Username, nginxHtpasswdHash(rule.Security.BasicAuth.PasswordHash))
+			if err := os.WriteFile(path, []byte(line), 0o644); err != nil {
+				return err
+			}
+			ensureNginxReadable(path, false)
+		}
+	}
+
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil
+		}
+		return err
+	}
+	for _, entry := range entries {
+		if entry.IsDir() {
+			continue
+		}
+		var id int64
+		if _, err := fmt.Sscanf(entry.Name(), "rule_%d.conf", &id); err != nil {
+			continue
+		}
+		if !active[id] {
+			_ = os.Remove(filepath.Join(dir, entry.Name()))
+		}
+	}
+	return nil
+}