ykxmz 1.5.0：修复手表端 TLS 证书校验 + MTU 修复网络稳定性

被控端
- 修复 MTU 问题：夹 MSS + 路径 MTU 探测（公网可用率 48% -> 100%）
- 复用 HTTP 连接（免掉每次新建 TLS 的 30% 握手失败）
- 每分钟回头找局域网，自动切回快 400 倍的路径
- 画面心跳帧：静止时省流量，客户端仍知道流是活的
- 锁屏时给出可操作的提示

手表端
- 内置 GTS Root R4 / GlobalSign Root CA，修 SSLHandshakeException
- 连接错误翻译成人话（证书/时间/解析/超时分别提示）
- 经中转连上后用服务器报的地址刷新已配对记录
- 新增局域网连接页面、服务器延迟检测

服务器端
- 支持 chunked 请求体（修每 16 秒一次的连接错乱与大面积 502）
- 网络调优脚本 net-tune.sh（开机自动应用）
- 管理页：批量删除、网络体检、下载区
- 隧道改 HTTP/2 + 双连接

文档
- 许可协议 / 安装前必读 / 安装后须知（作者：小麦子）

_build/probe_admin_width3.py

@@ -0,0 +1,132 @@
+# -*- coding: utf-8 -*-
+"""把"谁越界了"的结果直接画进页面，再截图。
+
+为什么绕这一圈：
+    --dump-dom 会忽略 --window-size（实测视口固定 492），
+    所以量不到 420px 的情况。
+    改成：脚本量完把结果写进 body，然后用 --screenshot 在 420 下拍下来。
+"""
+from __future__ import annotations
+
+import http.cookiejar
+import json
+import os
+import shutil
+import subprocess
+import sys
+import tempfile
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent
+UA = {"User-Agent": "LanRemote/1.4.0"}
+PORT = 8114
+BASE = f"http://127.0.0.1:{PORT}"
+
+EDGE = next((p for p in (
+    Path(r"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"),
+    Path(r"C:\Program Files\Microsoft\Edge\Application\msedge.exe"))
+    if p.is_file()), None)
+
+PROBE = """
+<script>
+(function () {
+  var vw = document.documentElement.clientWidth;
+  var lines = ['viewport=' + vw + '  scrollW=' + document.body.scrollWidth];
+  var all = document.querySelectorAll('*');
+  for (var i = 0; i < all.length; i++) {
+    var el = all[i];
+    var r = el.getBoundingClientRect();
+    if (r.right > vw + 0.5 || r.width > vw + 0.5) {
+      var cls = el.className ? ('.' + String(el.className).trim()
+                                .replace(/\\s+/g, '.')) : '';
+      lines.push(Math.round(r.width) + 'w right=' + Math.round(r.right)
+        + ' <' + el.tagName.toLowerCase() + cls + '>');
+      if (lines.length > 30) break;
+    }
+  }
+  document.body.innerHTML =
+    '<pre style="font:11px/1.5 Consolas,monospace;color:#0f0;'
+    + 'background:#000;margin:0;padding:10px;white-space:pre-wrap">'
+    + lines.join('\\n') + '</pre>';
+})();
+</script>
+"""
+
+
+def main() -> int:
+    work = Path(tempfile.mkdtemp(prefix="admin_probe3_"))
+    relay = None
+    try:
+        data = work / "d"
+        data.mkdir(parents=True, exist_ok=True)
+        env = dict(os.environ)
+        env.update({"RELAY_PORT": str(PORT), "RELAY_BIND": "127.0.0.1",
+                    "RELAY_DATA": str(data),
+                    "PYTHONIOENCODING": "utf-8", "PYTHONUNBUFFERED": "1"})
+        relay = subprocess.Popen(
+            [sys.executable, "-u", str(ROOT / "relay" / "relay.py")], env=env,
+            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
+        for _ in range(40):
+            time.sleep(0.5)
+            try:
+                urllib.request.urlopen(urllib.request.Request(
+                    BASE + "/v1/health", headers=UA), timeout=2)
+                break
+            except Exception:                             # noqa: BLE001
+                continue
+
+        for index, (name, code) in enumerate(
+                [("书房台式机", "482913"), ("笔记本", "771204")], start=1):
+            body = json.dumps({"deviceId": f"pc-{index}", "code": code,
+                               "name": name, "version": "1.4.0"}).encode()
+            urllib.request.urlopen(urllib.request.Request(
+                BASE + "/v1/agent/register", data=body, method="POST",
+                headers={**UA, "Content-Type": "application/json"}),
+                timeout=10).read()
+
+        jar = http.cookiejar.CookieJar()
+        opener = urllib.request.build_opener(
+            urllib.request.HTTPCookieProcessor(jar))
+        form = urllib.parse.urlencode({"password": "120830"}).encode()
+        req = urllib.request.Request(BASE + "/admin/login", data=form,
+                                     method="POST", headers=UA)
+        req.add_header("Content-Type", "application/x-www-form-urlencoded")
+        try:
+            opener.open(req, timeout=15).read()
+        except urllib.error.HTTPError:
+            pass
+
+        html = opener.open(urllib.request.Request(BASE + "/", headers=UA),
+                           timeout=15).read().decode("utf-8")
+        html = html.replace("</html>", PROBE + "</html>")
+        page = work / "p.html"
+        page.write_text(html, encoding="utf-8")
+
+        shot = ROOT / "_build" / "admin_overflow.png"
+        subprocess.run(
+            [str(EDGE), "--headless=new", "--disable-gpu", "--hide-scrollbars",
+             "--window-size=420,900", "--virtual-time-budget=4000",
+             f"--screenshot={shot}", page.as_uri()],
+            capture_output=True, timeout=90)
+        print(f"  {shot.name} {'ok' if shot.is_file() else '失败'}")
+        return 0
+    finally:
+        if relay is not None:
+            try:
+                relay.terminate()
+                relay.wait(timeout=8)
+            except Exception:                             # noqa: BLE001
+                try:
+                    relay.kill()
+                except Exception:                     # noqa: BLE001
+                    pass
+        time.sleep(0.5)
+        shutil.rmtree(work, ignore_errors=True)
+
+
+if __name__ == "__main__":
+    sys.exit(main())