feat: запасной MTProto TCP и CF-прокси через свой домен (по образцу Flowseal/tg-ws-proxy); 2.0.0-beta.17 (#73)

* feat: native MTProto TCP fallback and CF-proxy domains, after Flowseal/tg-ws-proxy; 2.0.0-beta.17

Two routes Flowseal/tg-ws-proxy has and TGLock lacked.

Native TCP fallback. When every WebSocket route for a DC fails, TGLock now
tries plain obfuscated2 MTProto to the DC's primary address, which the
CDN203 route already used. Measured from a Russian ISP: TLS to .51, .91,
.50, .100 and .5 was cut, while native TCP to each answered req_pq_multi,
for main and media DCs alike. 149.154.167.220 is a WebSocket frontend only
and gets no TCP route. TCP opens before Telegram answers, so it is raced
only after all other routes failed; it can never displace a slower working
WebSocket. Raw TCP stays restricted to the pinned Telegram addresses.

CF proxy. A user's own Cloudflare domain with kws1..kws5/kws203 records
pointing at Telegram proxies the WebSocket without a Worker or its limits
(--cf-proxy, cf_proxy in tglock.toml, a GUI field; docs/CF_PROXY.md).

GUI settings now deserialize with serde(default): a file written before a
field existed used to fail to parse and silently reset to defaults.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* style: cargo fmt

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: babin <Thartewerner536e@engineer.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

src/proxy.rs

@@ -269,6 +269,26 @@ impl Stats {
         }
     }
 
+    /// Свои домены на Cloudflare для CF-прокси (`kwsN.<домен>`, docs/CF_PROXY.md).
+    pub fn set_cf_proxy_domain(&self, domain: &str) {
+        let domains = domain
+            .split([',', ';', ' '])
+            .filter(|value| !value.trim().is_empty())
+            .map(str::to_owned)
+            .collect::<Vec<_>>();
+        let result = self.transport.set_cf_proxy_domains(&domains);
+        for rejected in &result.rejected {
+            self.note(format!(
+                "CF-прокси «{rejected}» не похож на имя домена — маршрут не добавлен.                  Нужен только домен, без https:// и без kws: example.com"
+            ));
+        }
+        for accepted in &result.accepted {
+            self.note(format!(
+                "CF-прокси в списке маршрутов: kws1.{accepted} … kws5.{accepted}, kws203.{accepted}"
+            ));
+        }
+    }
+
     pub fn stop(&self) {
         if let Some(sender) = self.shutdown.lock().unwrap().take() {
             let _ = sender.send(true);
@@ -919,7 +939,7 @@ async fn cdn_tcp_tunnel(
                         stats,
                         connected,
                         dc,
-                        "CDN TCP закрыт без ответа Telegram",
+                        "MTProto TCP закрыт без ответа Telegram",
                     ))
                 };
             }
@@ -1745,7 +1765,7 @@ mod tests {
         assert!(stats
             .drain_events()
             .iter()
-            .any(|event| event.contains("CDN TCP закрыт без ответа")));
+            .any(|event| event.contains("MTProto TCP закрыт без ответа")));
         relay.await.unwrap();
         stats.stop();
         server.await.unwrap().unwrap();