server_config: 重写为完整部署规范（BBR/nginx CONNECT/sing-box/mtg）

- 新增完整 README.md 部署规范：架构、端口规划、BBR 跨境优化、
  nginx 源码编译+CONNECT 隧道、sing-box(VLESS+REALITY/SS)、mtg(MTProto)、
  本机 IP 自动识别、systemd、启动顺序与验证清单
- nginx/nginx.conf：占位符版，proxy_connect_allow all + 回环保护
- sing-box/config.json：占位符版，VLESS+REALITY + SS
- systemd/：nginx/sing-box/mtg 服务文件
- scripts/sync-nginx-local-ips.sh：去除真实域名，占位符版
- fake-site/index.html：伪装页（清除真实品牌域名）
- 移除过时：traffic-monitor/、pac/、conf.d 具体站点配置
- 所有敏感值（IP/域名/端口/密钥）均以 <占位符> 表示

server_config/nginx/nginx.conf

@@ -1,4 +1,3 @@
-load_module /usr/lib/nginx/modules/ngx_http_proxy_connect_module.so;
 worker_processes auto;
 worker_rlimit_nofile 65535;
 events {
@@ -25,45 +24,15 @@ http {
     keepalive_timeout 65;
     keepalive_requests 100;
 
-    # 80 端口：iam.aeolianchi.me 强制跳转到 HTTPS（保留 ACME 验证路径）
+    # <nginx端口>：主域名 HTTPS 站点 + 认证 CONNECT 代理
     server {
-        listen 80;
-        server_name iam.aeolianchi.me;
-
-        location /.well-known/acme-challenge/ {
-            root /var/www/acme;
-        }
-
-        location / {
-            return 301 https://$host$request_uri;
-        }
-    }
-
-    # 80 端口：默认站点只做静态伪装，不提供代理、不弹认证
-    server {
-        listen 80 default_server;
-        server_name _;
-
-        root /var/www/html;
-        index index.html;
-
-        location /.well-known/acme-challenge/ {
-            root /var/www/acme;
-        }
-
-        location / {
-            try_files $uri $uri/ =404;
-        }
-    }
-
-    server {
-        listen 443 ssl;
+        listen <nginx端口> ssl;
         http2 on;
-        server_name XXX;
+        server_name <节点域名>;
         root /var/www/html;
 
-        ssl_certificate /etc/nginx/ssl/XXX/fullchain.pem;
-        ssl_certificate_key /etc/nginx/ssl/XXX/privkey.pem;
+        ssl_certificate /etc/nginx/ssl/<节点域名>/fullchain.pem;
+        ssl_certificate_key /etc/nginx/ssl/<节点域名>/privkey.pem;
         ssl_protocols TLSv1.2 TLSv1.3;
         ssl_ciphers HIGH:!aNULL:!MD5;
         ssl_session_cache shared:SSL:10m;
@@ -74,14 +43,14 @@ http {
         auth_basic_user_file /etc/nginx/.htpasswd;
 
         proxy_connect;
-        proxy_connect_allow 443 563;
+        proxy_connect_allow all;
         proxy_connect_connect_timeout 60s;
         proxy_connect_read_timeout 120s;
         proxy_connect_send_timeout 120s;
 
         location / {
             auth_basic off;
-            if ($host != "iam.aeolianchi.me") {
+            if ($host != "<节点域名>") {
                 rewrite ^ /__proxy last;
             }
             index index.html;
@@ -104,14 +73,14 @@ http {
         }
     }
 
-    # 443 端口 fallback：其他 SNI 也可用 CONNECT 代理；普通 GET 只返回伪装页
+    # <nginx端口> fallback：其他 SNI 也可用 CONNECT 代理；普通 GET 只返回伪装页
     server {
-        listen 443 ssl default_server;
+        listen <nginx端口> ssl default_server;
         http2 on;
         server_name _;
 
-        ssl_certificate /etc/nginx/ssl/iam.aeolianchi.me/fullchain.pem;
-        ssl_certificate_key /etc/nginx/ssl/iam.aeolianchi.me/privkey.pem;
+        ssl_certificate /etc/nginx/ssl/<节点域名>/fullchain.pem;
+        ssl_certificate_key /etc/nginx/ssl/<节点域名>/privkey.pem;
         ssl_protocols TLSv1.2 TLSv1.3;
         ssl_ciphers HIGH:!aNULL:!MD5;
         ssl_session_cache shared:SSL:10m;
@@ -122,7 +91,7 @@ http {
         auth_basic_user_file /etc/nginx/.htpasswd;
 
         proxy_connect;
-        proxy_connect_allow 443 563;
+        proxy_connect_allow all;
         proxy_connect_connect_timeout 60s;
         proxy_connect_read_timeout 120s;
         proxy_connect_send_timeout 120s;