feat(frp): frps vhost 回源端口支持 80/443，公网反代在该配置下不再适用

- 服务端表单不再硬性拒绝 vhostHTTPPort=80 / vhostHTTPSPort=443，改为保存时弹窗二次确认；
  确认后请求携带 allow_privileged_vhost_ports 提交并由后端校验放行，未携带标记的请求（含直接调 API）仍被拒绝
- frps.toml 生成改为写入风险注释、不再报错；各规则的公网反代回源地址随 80/443 自动跟随
- 「公网反代」页检测到 80/443 后显示说明卡片并隐藏统计/Nginx/规则台账/漂移区块，
  同时跳过 agent 的路由、漂移与健康请求
- 后端 DeployAgentRoute 与 RedeployAllRoutes（含漂移一键修复）拒绝下发，自动下发路径 syncAgentRoute 跳过
- 新增 internal/frp/vhost_port_test.go：校验、二次确认、frps.toml 生成、反代回源跟随与守卫对照

internal/api/frpmulti_handler.go

@@ -50,7 +50,9 @@ type frpServerRequest struct {
 	TLSTrustedCA           string            `json:"tls_trusted_ca"`
 	ClearTLSCertificate    bool              `json:"clear_tls_certificate"`
 	ClearTLSKey            bool              `json:"clear_tls_key"`
-	ClearTLSTrustedCA      bool              `json:"clear_tls_trusted_ca"`
+	// 二次确认标记：vhost 回源端口填 80/443 时前端必须带上
+	AllowPrivilegedVhostPorts bool `json:"allow_privileged_vhost_ports"`
+	ClearTLSTrustedCA         bool `json:"clear_tls_trusted_ca"`
 }
 
 type frpProxyRequest struct {
@@ -1061,6 +1063,7 @@ func (request frpServerRequest) serverInput() frp.ServerInput {
 		DashboardPassword: request.DashboardPassword, ClearDashboardPassword: request.ClearDashboardPassword,
 		TLSCertificate: request.TLSCertificate, TLSKey: request.TLSKey, TLSTrustedCA: request.TLSTrustedCA,
 		ClearTLSCertificate: request.ClearTLSCertificate, ClearTLSKey: request.ClearTLSKey, ClearTLSTrustedCA: request.ClearTLSTrustedCA,
+		AllowPrivilegedVhostPorts: request.AllowPrivilegedVhostPorts,
 	}
 }