chore(release): 发布 v1.9.2

- 「公网服务端」新增 Nginx 启停控制（Agent 0.15.2，停止带二次确认）
- frps 启动失败不再误报成功，并增强启动诊断
- frps vhost 端口禁止 80/443，避免与 VPS 上 Nginx 冲突
- 旧服务端配置的 tcp_mux / login_fail_exit 默认值补齐
- 新增安全审查、页面布局方案与场景操作文档

internal/frp/agent_tunnel_test.go

@@ -24,8 +24,8 @@ func TestAgentTunnelBindsLoopbackAndReleasesPort(t *testing.T) {
 		t.Fatal("隧道启动后本地端口应已被占用")
 	}
 	state, _ := tunnel.State()
-	if state != "connected" && state != "reconnecting" {
-		t.Fatalf("state=%q, want connected 或 reconnecting", state)
+	if state != "connecting" && state != "connected" && state != "reconnecting" {
+		t.Fatalf("state=%q, want connecting、connected 或 reconnecting", state)
 	}
 	tunnel.Stop()
 	if listener, err := net.Listen("tcp", fmt.Sprintf("127.0.0.1:%d", port)); err != nil {
@@ -51,3 +51,17 @@ func TestNextTunnelBackoff(t *testing.T) {
 		}
 	}
 }
+
+func TestAgentTunnelStopClosesActiveConnections(t *testing.T) {
+	tunnel := newAgentTunnel(context.Background(), 1, 0, SSHInstaller{})
+	server, client := net.Pipe()
+	defer client.Close()
+	if !tunnel.trackConn(server) {
+		t.Fatal("隧道运行时应能登记活动连接")
+	}
+	tunnel.Stop()
+	_ = client.SetReadDeadline(time.Now().Add(time.Second))
+	if _, err := client.Read(make([]byte, 1)); err == nil {
+		t.Fatal("隧道停止后活动连接应被关闭")
+	}
+}