fix: 铸渊专线订阅URL改为Nginx反代路径，解决端口3802外部不可达问题

根因：腾讯云安全组未开放3802端口，外部直连不可达。
修复：订阅URL从 :3802/sub/{token} 改为 /api/proxy-sub/sub/{token}，
     通过Nginx反代(端口80)访问，无需额外开放端口。

Agent-Logs-Url: https://github.com/qinfendebingshuo/guanghulab/sessions/14fb1c91-6f8d-467a-ae1d-a826754f5cca

Co-authored-by: qinfendebingshuo <207279273+qinfendebingshuo@users.noreply.github.com>

server/proxy/README.md

@@ -99,7 +99,7 @@ SG服务器总月流量: **2560 GB**
    → 通过邮件发送订阅URL到冰朔邮箱
 
 2. 冰朔在客户端添加订阅URL
-   → 客户端请求 https://server:3802/sub/{token}
+   → 客户端请求 http://server/api/proxy-sub/sub/{token}
    → 返回Clash YAML / Base64配置
    → 返回Header: subscription-userinfo (配额信息)
    → 客户端显示剩余流量

server/proxy/dashboard/update-dashboard.js

@@ -71,7 +71,7 @@ function readRemoteQuota() {
     return Promise.resolve(null);
   }
   return new Promise((resolve) => {
-    http.get(`http://${host}:3802/quota`, { timeout: 10000 }, (res) => {
+    http.get(`http://${host}/api/proxy-sub/quota`, { timeout: 10000 }, (res) => {
       let data = '';
       res.on('data', (d) => { data += d; });
       res.on('end', () => {

server/proxy/deploy-proxy.sh

@@ -268,6 +268,9 @@ update() {
     ensure_xray_root_user
     ensure_log_permissions
 
+    # 关闭3802外部端口 (订阅服务改为通过Nginx反代访问)
+    ufw delete allow 3802/tcp 2>/dev/null || true
+
     systemctl restart xray
     pm2 restart zy-proxy-sub zy-proxy-monitor zy-proxy-guardian 2>/dev/null || true
     health_check

server/proxy/service/send-subscription.js

@@ -116,7 +116,7 @@ function detectSmtpHost(email) {
 
 // ── 生成订阅邮件HTML ─────────────────────────
 function generateSubscriptionEmail(config) {
-  const subUrl = `http://${config.server_host}:3802/sub/${config.sub_token}`;
+  const subUrl = `http://${config.server_host}/api/proxy-sub/sub/${config.sub_token}`;
   const now = new Date().toLocaleString('zh-CN', { timeZone: 'Asia/Shanghai' });
 
   return `

server/proxy/setup/install-xray.sh

@@ -67,9 +67,14 @@ fi
 # ── 4. 防火墙配置 ────────────────────────────
 echo "[4/6] 配置防火墙..."
 ufw allow 443/tcp comment "Xray VLESS+Reality" || true
-ufw allow 3802/tcp comment "ZY-Proxy subscription service" || true
+# 端口3802不再需要外部直连 — 订阅服务通过Nginx反代(/api/proxy-sub/)访问
+if ufw delete allow 3802/tcp 2>/dev/null; then
+    echo "  ✅ 已移除3802端口外部访问规则"
+else
+    echo "  ℹ️ 3802端口规则不存在 (无需移除)"
+fi
 ufw reload || echo "⚠️ 防火墙重载失败，请手动检查"
-echo "  防火墙已配置: 443(Xray) + 3802(订阅服务)"
+echo "  防火墙已配置: 443(Xray) · 订阅服务走Nginx反代(端口80)"
 
 # ── 5. 生成密钥 ──────────────────────────────
 echo "[5/6] 生成密钥..."