feat: 证书探测改走国内机真 Node —— Workers 拿不到证书正文的兜底方案

根因：Workers 上 cloudflare:sockets 没有 getPeerCertificate，
node:tls 的同名方法是桩函数（调用即抛 not implemented）。

- editor-api 新增 /ssl-probe 本地端点（真 Node，读对端证书正文）：
  不外发、不落盘；ssl 白名单放行，admin/ssl 可用，editor/匿名拒绝
- certprobe 改两级：首选国内机（带 X-Editor-Token），失败自动降级本地握手
- certProbe/certCheck 接线 EDITOR_API_BASE + EDITOR_TOKEN，撤掉 ?debug 诊断
- wrangler.toml 显式开 nodejs_compat（compat date 早于默认启用阈值）
- 手写 node:tls 最小类型声明（保持零依赖）
- seed-ssl-config.mjs 净化：真实凭据移到 secrets-backup/certkeeper-seeds.json，
  TOKEN_SECRET 改从 .dev.vars 读；脚本本体不含任何凭据
- role-perm 新增第 9 节 12 项（59/59），UI 探测 37 项全过

blog-admin/tools/probe-ssl-ui.mjs

@@ -38,9 +38,9 @@ const DAY = 86400000;
 const MOCK = {
   '/api/v2/ssl/overview': {
     domains: [
-      { name: 'usj.cc', san: ['usj.cc', '*.usj.cc'], dns: 'tencent-usj', deploy: ['dogecloud', '1panel'], disabled: false, hasCert: true, expireAt: Date.now() + 61 * DAY, expireText: '2026-12-07 00:00:00', issuer: 'LiteSSL', updatedAt: Date.now(), daysLeft: 61, level: 'ok' },
-      { name: 't-t.live', san: ['t-t.live', '*.t-t.live'], dns: 'tencent-tt', deploy: ['1panel'], disabled: false, hasCert: true, expireAt: Date.now() + 82 * DAY, expireText: '2026-12-27 00:00:00', issuer: "Let's Encrypt", updatedAt: Date.now(), daysLeft: 82, level: 'ok' },
-      { name: '200181.xyz', san: ['200181.xyz', '*.200181.xyz'], dns: 'cloudflare', deploy: ['1panel'], disabled: false, hasCert: true, expireAt: Date.now() + 19 * DAY, expireText: '2026-10-25 00:00:00', issuer: 'LiteSSL', updatedAt: Date.now(), daysLeft: 19, level: 'warn' },
+      { name: 'usj.cc', san: ['usj.cc', '*.usj.cc'], dns: 'tencent-usj', deploy: ['dogecloud', '1panel'], disabled: false, hasCert: true, expireAt: Date.now() + 62 * DAY, expireText: '2026-12-07 06:59:59', issuer: 'TrustAsia Technologies, Inc.', updatedAt: Date.now(), daysLeft: 62, level: 'ok' },
+      { name: 't-t.live', san: ['t-t.live', '*.t-t.live'], dns: 'tencent-tt', deploy: ['1panel'], disabled: false, hasCert: true, expireAt: Date.now() + 83 * DAY, expireText: '2026-12-27 16:02:51', issuer: "Let's Encrypt", updatedAt: Date.now(), daysLeft: 83, level: 'ok' },
+      { name: '200181.xyz', san: ['200181.xyz'], dns: 'cloudflare', deploy: ['1panel'], disabled: false, hasCert: true, expireAt: Date.now() + 19 * DAY, expireText: '2026-10-25 12:56:26', issuer: 'LiteSSL', updatedAt: Date.now(), daysLeft: 19, level: 'warn' },
       { name: 'new.example.com', san: ['new.example.com'], dns: 'cloudflare', deploy: [], disabled: false, hasCert: false, expireAt: null, expireText: null, issuer: '', updatedAt: null, daysLeft: null, level: 'none' },
     ],
     orphans: ['old.example.org'],
@@ -48,6 +48,14 @@ const MOCK = {
     mailEnabled: true,
     serverTime: '2026-10-06 12:00:00',
   },
+  // 实测探针的返回形状 —— 与真接口一致（国内机 /ssl-probe 的字段）
+  '/api/v2/ssl/probe': {
+    ok: true, handshakeFailed: false, host: 'usj.cc', tlsVersion: 'TLSv1.3',
+    subject: 'usj.cc', issuer: 'TrustAsia Technologies, Inc.',
+    altNames: ['usj.cc', '*.usj.cc'],
+    notAfter: Date.now() + 62 * DAY, notBefore: Date.now() - 28 * DAY,
+    daysLeft: 62, notAfterText: '2026-12-07 06:59:59',
+  },
   '/api/v2/ssl/access': {
     items: [
       { name: 'tencent-usj', type: 'tencentcloud', note: '小赵腾讯云', fields: { secretId: 'AKID********3f2a', secretKey: 'Qk9Y****gAAA' } },
@@ -294,11 +302,16 @@ try {
   await sleep(3000);
   await ev(`(() => { const b = [...document.querySelectorAll('#tabs .tab')].find(x => x.textContent.includes('证书管家')); if (b) b.click(); })()`);
   await sleep(2000);
+  // 点一次「实测」——本轮改的就是探测链路，把结果弹窗截进画面才看得见。
+  await ev(`(() => { const b = document.querySelector('button[data-act="ssl-probe"]'); if (b) b.click(); })()`);
+  await sleep(2000);
   await ev(`document.documentElement.setAttribute('data-theme','light')`);
   await sleep(500);
   {
     const s = await send('Page.captureScreenshot', { format: 'png', captureBeyondViewport: true });
-    const out = join(root, '..', '.editor-tmp', 'ssl-panel-light.png');
+    // ★ 落点必须用**项目**目录（root），不是临时目录：临时目录跑完整个被删，
+    //   截图写进去等于没写（上一版就是这样，人眼永远看不到）。
+    const out = join(root, '.editor-tmp', 'ssl-panel-light.png');
     mkdirSync(dirname(out), { recursive: true });
     writeFileSync(out, Buffer.from(s.result.data, 'base64'));
     console.log('\n截图：' + out);