Полный продовый фикс HY2XS/Hysteria2: auth DTO, валидация bind, smoke, URI, preflight и env-контракт

package/config/hy2xs.env

@@ -4,9 +4,8 @@ HY2XS_DOMAIN=uk.api.withen.pro
 HY2XS_PUBLIC_HOST=uk.api.withen.pro
 HY2XS_PUBLIC_PORT=443
 HY2XS_SSH_PORT=22
-HY2XS_FIREWALL_ENABLED=true
+HY2XS_FIREWALL_MODE=managed
 HY2XS_FIREWALL_STAGED_APPLY=true
-HY2XS_FIREWALL_ALLOW_TAKEOVER=false
 HY2XS_UI_BIND_HOST=127.0.0.1
 HY2XS_UI_PUBLIC_ACCESS=false
 HY2XS_UI_PORT=8080
@@ -22,10 +21,12 @@ HY2XS_TLS_CERT_PATH=/etc/hysteria/server.crt
 HY2XS_TLS_KEY_PATH=/etc/hysteria/server.key
 HY2XS_HYSTERIA_BIND_HOST=0.0.0.0
 HY2XS_HYSTERIA_PORT=443
+# fixed in production profile: must remain http
 HY2XS_HYSTERIA_AUTH_MODE=http
 HY2XS_HYSTERIA_TRAFFIC_STATS_HOST=127.0.0.1
 HY2XS_HYSTERIA_TRAFFIC_STATS_PORT=36712
 HY2XS_HYSTERIA_TRAFFIC_STATS_SECRET=__GENERATE__
+# fixed in production profile: must remain salamander
 HY2XS_HYSTERIA_OBFS_TYPE=salamander
 HY2XS_HYSTERIA_OBFS_PASSWORD=__GENERATE__
 HY2XS_HYSTERIA_BANDWIDTH_UP=50 mbps