feat: sing-box Clash template support + Docker CI + frontend scaffold

- Clash→sing-box template conversion engine (singbox_template.go)
- Auto-map 40+ Clash rule-providers to sing-box .srs binary rule-sets
- Fix sing-box 1.11+/1.12+ migrations (sniff/block/WireGuard/DNS/rule_set)
- Fix WireGuard URI '+' parsing bug (rawParamGet)
- Add REJECT block outbound for selector group references
- Skip rules referencing rule-sets with no sing-box equivalent
- Verified: sing-box run succeeds with ACL4SSR template (16 rule-sets loaded)
- Add Dockerfile (multi-stage Go build)
- Add GitHub Actions workflow (multi-arch: amd64+arm64, push to ghcr.io)
- Add frontend scaffold (Vue3 + Vite + Tailwind)

internal/render/dispatch.go

@@ -31,7 +31,7 @@ func RenderTarget(proxies []model.ProxyNode, target string, template map[string]
 	case model.TargetQX:
 		return RenderQxProxies(proxies)
 	case model.TargetSingBox:
-		return RenderSingBoxJson(proxies), nil
+		return RenderSingBoxWithTemplate(proxies, template), nil
 	case model.TargetV2ray:
 		return util.Base64Utf8(RenderProxyUris(proxies)), nil
 	case model.TargetURI, model.TargetShadowrocket:
@@ -63,7 +63,7 @@ func RenderBuildTarget(proxies []model.ProxyNode, target string, requestUrl stri
 	case model.TargetQX:
 		return RenderQxProxies(proxies)
 	case model.TargetSingBox:
-		return RenderSingBoxJson(proxies), nil
+		return RenderSingBoxWithTemplate(proxies, template), nil
 	case model.TargetV2ray:
 		return util.Base64Utf8(RenderProxyUris(proxies)), nil
 	case model.TargetURI: