🔎 Decide public exposure of /diagnostic + constants.ts fronting intel

[sepehrsadri]

The unauthenticated GET /diagnostic endpoint and tools/smart-sub/src/constants.ts publish the operational fronting strategy in the clear: the annotated host-priority list (with notes like which hosts are considered un-blockable), the per-ISP fragment profiles, and ISP DNS resolver IPs.

Much of the underlying protocol knowledge is already public in xray/sing-box docs, but the specific, annotated combination is a ready-made block list for this deployment.

Decide deliberately what the threat model permits shipping publicly:

• Move the annotated host-priority / resolver intel into operator-only (SOPS) config, or accept it as public and treat these values as adversary-known (rotate the host set / SNIs periodically)
• Consider gating GET /diagnostic behind a credential, or stripping resolver/host specifics from its unauthenticated response