Harden profile deployment and add verified GCP ingress recovery

[mtmtian]

When the local network cannot reach the GCP public IP, the Cloudflare fallback must be checked through the actual local ingress path. IP recovery must update the VM binding and local state together instead of persisting an unbound address.

This release adds a verified Cloudflare ingress path and GCP IP recovery, together with the profile deployment and client-generation safeguards they depend on:

• Probe each device through TLS/WebSocket/VLESS and an authenticated HTTPS request; optionally bind physical-interface probes to bypass local TUN/fake-IP. Wait for cloudflared connections before publishing client output.
• Add account-pinned GCP binding checks, dry-run/apply recovery commands, serialized profile operations, a recovery journal, rollback and explicit old-address cleanup.
• Share literal configuration parsing and atomic client output; keep Stash and Mihomo schemas separate and refresh fallback checks.
• Harden deployment artifact checksums, staged Xray validation, SSH recovery, credential revocation and provider isolation. Document operation and recovery commands.

Validation:

• Shell syntax checks and git diff --check: passed.
• python3 -m unittest discover -s tests -p 'test_*.py': 87 tests, 83 passed and 4 native Mihomo parser tests skipped locally because the binary is unavailable. CI passed, including all 4 native parser checks with pinned Mihomo v1.19.30.
• Current GCP deployment completed; both configured devices passed the physical-interface Cloudflare HTTPS probe. Client outputs were generated and their existing device-sync copies matched.
• Live GCP address-binding check and rotation dry-run passed. Real address rotation/rollback and deployment to other VPS providers were not performed.
• Sensitive profile state and generated client credentials are excluded from this public PR.

Deployment and recovery:

Merged main revision 71c4dcd843d91307ad652a9dbbcb5595a3986288 was deployed successfully with bash deploy-gcp.sh. Both configured devices passed the physical-interface end-to-end CDN probe. Post-deploy ip-check and client check passed; xray, hysteria, anytls and cloudflared were all active. Final client output matched both existing device-sync copies. Merged-main CI also passed. Deployment restarts proxy services briefly. IP recovery retains the previous address until explicit finalization; the deployment script does not provide a transactional rollback of every server change.