feat: запасной MTProto TCP и CF-прокси через свой домен (по образцу Flowseal/tg-ws-proxy); 2.0.0-beta.17 (#73)

* feat: native MTProto TCP fallback and CF-proxy domains, after Flowseal/tg-ws-proxy; 2.0.0-beta.17

Two routes Flowseal/tg-ws-proxy has and TGLock lacked.

Native TCP fallback. When every WebSocket route for a DC fails, TGLock now
tries plain obfuscated2 MTProto to the DC's primary address, which the
CDN203 route already used. Measured from a Russian ISP: TLS to .51, .91,
.50, .100 and .5 was cut, while native TCP to each answered req_pq_multi,
for main and media DCs alike. 149.154.167.220 is a WebSocket frontend only
and gets no TCP route. TCP opens before Telegram answers, so it is raced
only after all other routes failed; it can never displace a slower working
WebSocket. Raw TCP stays restricted to the pinned Telegram addresses.

CF proxy. A user's own Cloudflare domain with kws1..kws5/kws203 records
pointing at Telegram proxies the WebSocket without a Worker or its limits
(--cf-proxy, cf_proxy in tglock.toml, a GUI field; docs/CF_PROXY.md).

GUI settings now deserialize with serde(default): a file written before a
field existed used to fail to parse and silently reset to defaults.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* style: cargo fmt

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: babin <Thartewerner536e@engineer.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

ui/main.ts

@@ -34,6 +34,7 @@ type Settings = {
   lanMode: boolean;
   port: number;
   workerDomain: string;
+  cfProxyDomain: string;
 };
 
 const root = document.querySelector<HTMLDivElement>("#app")!;
@@ -55,7 +56,7 @@ let status: Status = {
   shareAddress: null,
   logs: [],
 };
-let settings: Settings = { lanMode: false, port: 1080, workerDomain: "" };
+let settings: Settings = { lanMode: false, port: 1080, workerDomain: "", cfProxyDomain: "" };
 let busy = false;
 let toastTimer: number | undefined;
 let toastMessage = "";
@@ -232,6 +233,20 @@ function renderSettings(): void {
           <p class="field-hint">Необязательно. Используется как резервный маршрут.</p>
         </div>
 
+        <div class="setting-card">
+          <label class="field-label" for="cf-proxy">Свой домен на Cloudflare</label>
+          <input
+            id="cf-proxy"
+            name="cf-proxy"
+            type="text"
+            value="${escapeHtml(settings.cfProxyDomain)}"
+            placeholder="example.com"
+            autocomplete="off"
+            ${status.running ? "disabled" : ""}
+          />
+          <p class="field-hint">Необязательно. CF-прокси без Worker: записи kws1…kws5 и kws203 на адреса Telegram.</p>
+        </div>
+
         <div class="setting-list">
           <label class="setting-row" for="lan-mode">
             <span>
@@ -403,9 +418,10 @@ async function saveSettings(event: Event): Promise<void> {
   event.preventDefault();
   if (busy || status.running) return;
   const worker = document.querySelector<HTMLInputElement>("#worker");
+  const cfProxy = document.querySelector<HTMLInputElement>("#cf-proxy");
   const lanMode = document.querySelector<HTMLInputElement>("#lan-mode");
   const port = document.querySelector<HTMLInputElement>("#port");
-  if (!worker || !lanMode || !port) return;
+  if (!worker || !cfProxy || !lanMode || !port) return;
 
   const parsedPort = Number(port.value);
   if (!Number.isInteger(parsedPort) || parsedPort < 1 || parsedPort > 65535) {
@@ -416,6 +432,7 @@ async function saveSettings(event: Event): Promise<void> {
   busy = true;
   settings = {
     workerDomain: worker.value.trim(),
+    cfProxyDomain: cfProxy.value.trim(),
     lanMode: lanMode.checked,
     port: parsedPort,
   };
@@ -451,7 +468,7 @@ async function copyDiagnostics(): Promise<void> {
     // Public reports exclude proxy links, worker domains and free-form logs.
     const report = {
       application: "TGLock",
-      version: "2.0.0-beta.16",
+      version: "2.0.0-beta.17",
       running: status.running,
       activeConnections: status.activeConnections,
       tunnels: status.tunnels,