feat: add Snell v3–v6 client outbound

[Minis233]

Summary

Add Snell client outbound to exclave-core, covering v3–v6.

• Protocol stack adapted from SagerNet/sing-snell (same as sing-box testing branch), inlined under proxy/snell/internal/singsnell so the module stays self-contained.
• JSON protocol name: "snell"
• Features: TCP CONNECT, UDP-over-TCP, obfs none|http|tls, connection reuse, Snell v6 modes default|unshaped|unsafe-raw
• Conf loader: infra/conf/v4/snell.go
• Registered in main/distro/all and outboundConfigLoader

Settings example

{
  "protocol": "snell",
  "settings": {
    "address": "1.2.3.4",
    "port": 44046,
    "psk": "secret",
    "obfs": "tls",
    "obfsHost": "www.bing.com",
    "version": 6,
    "reuse": true,
    "mode": "default"
  }
}

Notes

• Snell carries its own AEAD; do not enable streamSettings TLS. Use obfs: "tls" for the fake TLS handshake.
• Inlined against exclave-core’s current sing v0.8.11 (vectorised/packet-batch creator APIs from newer sing are stubbed; wire protocol is intact).
• Companion Android UI PR will follow against ExclaveNetwork/Exclave.

Test plan

• Built via forked Exclave debug workflow with this core branch
• Real-device connect verified by reporter (Snell server reachable)
• Review: TCP + UDP with snell-server v4/v5
• Review: TCP + UDP with official Snell v6 (default mode)
• Review: obfs none / http / tls

[dyhkwong]

• Import sing-snell directly. It is okay to update sing to an unstable version.
• Why did you add Snell v3? I don't think it is supported. Please correct it.
• Option field paring should be as strict as possible. For example, version should accept 4 and 6 only, obfs doesn't need to be case-sensitive, and don't treat "off" as the alias of "none". Don't allow non-empty v4-only fields in v6 and vise versa.
• Rename obfs to obfsMode.
• The reader, ok := link.Reader.(buf.TimeoutReader) logic is for server-speaks-first protocols. Please check if server-speaks-first protocols work without that logic. Don't add that logic unless it is necessary.
• userPSK is sing-box's private extension and only compatible with sing-box server. Please add it for now. Let's defer considering how to deal with it.
• Does Snell server accept empty PSK?
• For UDP, Snell protocol only supports replying with IP address. For UDP domain address destination. if sing-snell does not handle this, we may need to handle this ourselves.
• Snell v6 is still in beta. Should we wait for the stable version?

[Minis233]

Thanks for the review — addressed in the latest commit:

1. Import sing-snell directly and bump github.com/sagernet/sing to the unstable revision required by sing-snell. Added HandshakeTimeout / SetHandshakeTimeout no-ops on singbridge.tlsConfigWrapper for the new sing/common/tls.Config surface.
2. Versions: 4 and 6 only (removed v3/v5).
3. Strict option parsing
   • version: 4 | 6 only (0 → 4)
   • obfsMode: exact none | http | tls (empty → none; no "off" alias; case-sensitive)
   • mode (v6): exact default | unshaped | unsafe-raw
   • Reject non-empty v4-only fields on v6 (obfsHost, non-none obfsMode) and v6-only mode on v4
4. Renamed JSON field obfs → obfsMode.
5. Removed server-speaks-first first-payload logic — Snell is client-speaks-first (CONNECT header before app data).
6. Added userPSK (sing-box private extension / UserKey); optional for now.
7. Empty PSK allowed — sing-snell does not reject empty PSK; key material is Argon2id-derived and servers may accept empty.
8. UDP domains: Snell UDP ATYP is IPv4/IPv6 only. Outbound now resolves FQDN destinations (session resolver if present, else system) to IP before WritePacket.
9. v6 beta: still exposed (marked beta in the app UI). Happy to gate it behind a build flag or drop from UI until sing-snell/sing-box call it stable — preference?

Companion app PR: ExclaveNetwork/Exclave#446