feat(frp): frps vhost 回源端口支持 80/443，公网反代在该配置下不再适用

- 服务端表单不再硬性拒绝 vhostHTTPPort=80 / vhostHTTPSPort=443，改为保存时弹窗二次确认；
  确认后请求携带 allow_privileged_vhost_ports 提交并由后端校验放行，未携带标记的请求（含直接调 API）仍被拒绝
- frps.toml 生成改为写入风险注释、不再报错；各规则的公网反代回源地址随 80/443 自动跟随
- 「公网反代」页检测到 80/443 后显示说明卡片并隐藏统计/Nginx/规则台账/漂移区块，
  同时跳过 agent 的路由、漂移与健康请求
- 后端 DeployAgentRoute 与 RedeployAllRoutes（含漂移一键修复）拒绝下发，自动下发路径 syncAgentRoute 跳过
- 新增 internal/frp/vhost_port_test.go：校验、二次确认、frps.toml 生成、反代回源跟随与守卫对照

internal/frp/validate_test.go

@@ -57,17 +57,22 @@ func TestValidateServerInputVhostPorts(t *testing.T) {
 		name    string
 		http    int
 		https   int
+		confirm bool
 		wantErr bool
 	}{
 		{name: "默认端口", http: 8080, https: 8443},
-		{name: "HTTP 80 与 Nginx 冲突", http: 80, https: 8443, wantErr: true},
-		{name: "HTTPS 443 与 Nginx 冲突", http: 8080, https: 443, wantErr: true},
+		{name: "HTTP 80 未二次确认", http: 80, https: 8443, wantErr: true},
+		{name: "HTTPS 443 未二次确认", http: 8080, https: 443, wantErr: true},
+		{name: "HTTP 80 已二次确认", http: 80, https: 8443, confirm: true},
+		{name: "HTTPS 443 已二次确认", http: 8080, https: 443, confirm: true},
+		{name: "80 与 443 同时使用且已二次确认", http: 80, https: 443, confirm: true},
 	}
 	for _, testCase := range cases {
 		t.Run(testCase.name, func(t *testing.T) {
 			input := normalizeServerInput(base)
 			input.Options.VhostHTTPPort = testCase.http
 			input.Options.VhostHTTPSPort = testCase.https
+			input.AllowPrivilegedVhostPorts = testCase.confirm
 			err := validateServerInput(input)
 			if (err != nil) != testCase.wantErr {
 				t.Fatalf("validateServerInput() error = %v, wantErr %v", err, testCase.wantErr)