feat: Wormhole 内网穿透与反向代理网关

Go + Vue 管理台：Agent 隧道、域名反代、IP 安全、访客验证与监控大盘。
Gitea Actions CI 多架构镜像；纯 Go SQLite、无 CGO Docker 构建。

Co-authored-by: Cursor <cursoragent@cursor.com>

migrations/002_proxy_headers.sql

@@ -0,0 +1,10 @@
+-- Proxy headers and IP forward mode for clients, tunnels, hosts
+
+ALTER TABLE clients ADD COLUMN ip_forward_mode TEXT DEFAULT 'real';
+ALTER TABLE clients ADD COLUMN custom_headers TEXT DEFAULT '';
+
+ALTER TABLE tunnels ADD COLUMN ip_forward_mode TEXT DEFAULT 'real';
+ALTER TABLE tunnels ADD COLUMN custom_headers TEXT DEFAULT '';
+
+ALTER TABLE hosts ADD COLUMN ip_forward_mode TEXT DEFAULT 'real';
+ALTER TABLE hosts ADD COLUMN custom_headers TEXT DEFAULT '';