chore: 初始提交 Fonu 1.0.2

- 公网反代：Nginx 状态卡片（版本 / 运行状态 / 配置校验 / 端口监听）
- 部署设置第一、二梯队（HTTPS 开关、安全头、限流、连接数、仅中国大陆 IP）
- 隧道检测兼容 frps v0.68 / v0.71（V2 与旧版端点）
- 恢复被清空的 internal/frp/store.go、internal/api/ddns_handler.go、web/src/views/DdnsView.vue

internal/nginx/realip.go

@@ -0,0 +1,99 @@
+package nginx
+
+import (
+	"encoding/json"
+	"strings"
+)
+
+type TrustedProxyConfig struct {
+	Enabled    bool     `json:"enabled"`
+	Preset     string   `json:"preset"` // "", "cloudflare", "custom"
+	CIDRs      []string `json:"cidrs,omitempty"`
+	Header     string   `json:"header,omitempty"` // CF-Connecting-IP, X-Real-IP, X-Forwarded-For
+	Recursive  bool     `json:"recursive,omitempty"`
+}
+
+var cloudflareIPv4 = []string{
+	"173.245.48.0/20",
+	"103.21.244.0/22",
+	"103.22.200.0/22",
+	"103.31.4.0/22",
+	"141.101.64.0/18",
+	"108.162.192.0/18",
+	"190.93.240.0/20",
+	"188.114.96.0/20",
+	"197.234.240.0/22",
+	"198.41.128.0/17",
+	"162.158.0.0/15",
+	"104.16.0.0/13",
+	"104.24.0.0/14",
+	"172.64.0.0/13",
+	"131.0.72.0/22",
+}
+
+var cloudflareIPv6 = []string{
+	"2400:cb00::/32",
+	"2606:4700::/32",
+	"2803:f800::/32",
+	"2405:b500::/32",
+	"2405:8100::/32",
+	"2a06:98c0::/29",
+	"2c0f:f248::/32",
+}
+
+func ParseTrustedProxyJSON(raw string) TrustedProxyConfig {
+	raw = strings.TrimSpace(raw)
+	if raw == "" || raw == "{}" {
+		return TrustedProxyConfig{}
+	}
+	var cfg TrustedProxyConfig
+	_ = json.Unmarshal([]byte(raw), &cfg)
+	return cfg
+}
+
+func (c TrustedProxyConfig) effectiveCIDRs() []string {
+	if !c.Enabled {
+		return nil
+	}
+	switch c.Preset {
+	case "cloudflare":
+		out := make([]string, 0, len(cloudflareIPv4)+len(cloudflareIPv6))
+		out = append(out, cloudflareIPv4...)
+		out = append(out, cloudflareIPv6...)
+		return out
+	default:
+		return c.CIDRs
+	}
+}
+
+func (c TrustedProxyConfig) effectiveHeader() string {
+	if c.Header != "" {
+		return c.Header
+	}
+	if c.Preset == "cloudflare" {
+		return "CF-Connecting-IP"
+	}
+	return "X-Forwarded-For"
+}
+
+func writeRealIPDirectives(b *strings.Builder, cfg TrustedProxyConfig) {
+	writeRealIPComment(b, cfg)
+	cidrs := cfg.effectiveCIDRs()
+	if len(cidrs) == 0 {
+		b.WriteString("    map $remote_addr $fonu_client_ip {\n")
+		b.WriteString("        default $remote_addr;\n")
+		b.WriteString("    }\n\n")
+		return
+	}
+	for _, cidr := range cidrs {
+		b.WriteString("    set_real_ip_from " + cidr + ";\n")
+	}
+	header := cfg.effectiveHeader()
+	b.WriteString("    real_ip_header " + header + ";\n")
+	if cfg.Recursive || header == "X-Forwarded-For" {
+		b.WriteString("    real_ip_recursive on;\n")
+	}
+	b.WriteString("\n    map $remote_addr $fonu_client_ip {\n")
+	b.WriteString("        default $remote_addr;\n")
+	b.WriteString("    }\n\n")
+}