feat(proxy-subscription): generate the local proxy-core configuration (opt-in)

[maxmad64bis]

⚠️ base-red inherited: #15306

Summary

Keeping a live proxy subscription in sync by hand is permanent manual work. The app now generates what it owns — local entries, groups, passed-through node definitions — into a file next to the operator's, only when the operator opts in. Nothing is overwritten. Generated group assignment and node tags now derive from a stable node identity (endpoint, port, credentials, transport) instead of the display name, so feeds where many nodes share one name spread across every group and reorderings keep each tag on its server; the previous output used the display name with positional suffixes (dup-2, dup-3), the new output uses identity-derived suffixes (dup-<6 hex chars>). At the first sync after this change, feeds with duplicated names report a changed member digest and reload once through the control API.

Related Issues

• Related to feat(providers): generate the local proxy-core config from a subscription's nodes #14896
• Related to [defer] feat(proxy): steer local core selector off set-aside members #14752

Validation

• Change type: provider
• Focused tests and category gates from the golden path
• npm run lint — ESLint on the touched files is clean; the full run is red on the base (🔴 Release branch not green: release/v3.8.52 #15306)
• Reconciled with the current active release base; focused checks rerun afterward
• Production-code changes include a new or updated automated test in this PR

Tests Added Or Updated

• tests/unit/proxySubscription.coreModel.test.ts (new: identity-derived tags stable under permutation, rendezvous group stability, sourceless-node fallback, object/URI identity match, missing-vs-explicit port, NFC names, same-name spread, group removal moves only its members, exact duplicates share one group, selector-shared lines form one group)
• tests/unit/proxySubscription.coreRenderSingbox.test.ts (new: unrenderable-only groups reported as empty_group, mixed rendered/unrenderable groups, fully rendered groups silent)
• tests/unit/proxySubscription.coreConfigSync.test.ts (new: unassigned groups logged per group, populated generation silent, unchanged rerun silent, skip line carries counts only, no accumulated state across generations)

Coverage Notes

• src/lib/proxySubscription/coreConfig/model.ts, src/lib/proxySubscription/parse.ts — proxySubscription.coreModel.test.ts
• src/lib/proxySubscription/coreConfig/singbox.ts, src/lib/proxySubscription/coreConfig/renderers.ts — proxySubscription.coreRenderSingbox.test.ts
• src/lib/proxySubscription/coreConfig/sync.ts — proxySubscription.coreConfigSync.test.ts
• src/lib/proxySubscription/coreConfig/pathGuard.ts, src/lib/proxySubscription/schema.ts — proxy-subscriptions-route-validation.test.ts
• src/lib/proxySubscription/subscriptionService.ts — proxySubscription.coreConfigSync.test.ts and proxySubscription.selectorWarning.test.ts
• src/lib/proxySubscription/selectorTrigger.ts — proxySubscription.selectorWarning.test.ts

Reviewer Notes

• Behavior: The 67 src/i18n/messages files carry the 3 new flat keys, zero __MISSING__; docs/i18n/*/llm.txt mirrors are synced (check-docs-sync green).
• Merge: feat(proxy-subscription): verify the generated core configuration before replacing the file #15142 builds on this change; fix(proxy): switch selector on every set-aside kind, not quota only #15140 touches the same file, either order. Counters (AGENTS.md, README.md, llm.txt, docs/i18n/*/llm.txt) stay with the release train (fix(proxies): steer selector to members without recent refusals #14804): this head keeps the base text untouched; the docs-all delta is only the new migration counter, left to the maintainer. feat(proxy-subscription): reload the proxy core after a verified config replacement #15238 and feat(proxy-subscription): prune nodes the core check rejects, then retry verification #15295 share these files in the same stack: parent first. Migration number 197 is also claimed by perf(db): drop two conversation_turn_nodes indexes no query reads #15354 (opened 2026-10-02, after this PR took it 2026-09-29); the release train decides the winner, this PR keeps its file in place.
• Follow-up: Translated subscription warning for skipped entries (dedicated key, 43 locales) lands separately.