feat: sing-box Clash template support + Docker CI + frontend scaffold

- Clash→sing-box template conversion engine (singbox_template.go)
- Auto-map 40+ Clash rule-providers to sing-box .srs binary rule-sets
- Fix sing-box 1.11+/1.12+ migrations (sniff/block/WireGuard/DNS/rule_set)
- Fix WireGuard URI '+' parsing bug (rawParamGet)
- Add REJECT block outbound for selector group references
- Skip rules referencing rule-sets with no sing-box equivalent
- Verified: sing-box run succeeds with ACL4SSR template (16 rule-sets loaded)
- Add Dockerfile (multi-stage Go build)
- Add GitHub Actions workflow (multi-arch: amd64+arm64, push to ghcr.io)
- Add frontend scaffold (Vue3 + Vite + Tailwind)

Dockerfile

@@ -0,0 +1,25 @@
+# ─── Stage 1: Build backend ───
+FROM golang:1.26-alpine AS backend-builder
+RUN apk add --no-cache git ca-certificates
+WORKDIR /app
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /sub-store .
+
+# ─── Stage 2: Runtime ───
+FROM alpine:3.21
+RUN apk add --no-cache ca-certificates tzdata
+WORKDIR /app
+COPY --from=backend-builder /sub-store /app/sub-store
+COPY config/config.example.yaml /app/config/config.example.yaml
+
+RUN mkdir -p /app/data
+
+ENV TZ=Asia/Shanghai
+ENV SUB_STORE_CONFIG=/app/config/config.yaml
+
+EXPOSE 3000
+
+ENTRYPOINT ["/app/sub-store"]
+CMD ["serve", "-c", "/app/config/config.yaml"]