feat: customer-level credentials shared across all nodes (item 2)

One credential set per customer (UUID + 32-byte root relay key + shortId)
lives on the customer record; node bindings no longer store credentials.
SS2022 user keys derive deterministically from the root key by method
length (16/24/32-byte prefix), so a single password serves every protocol,
matching 3x-ui's per-client credential model. Reality public keys stay a
node property and are shown per binding in the credentials pane.

- store: load-time convergence — first binding's set wins; a converged
  password that is not a 32-byte root key is regenerated (uuid/shortId
  preserved); bindings are stripped; idempotent, covered by tests
- deploy: the orchestrator stamps the customer's set onto a build copy;
  subscriptions resolve the same set; the derivation applies in both the
  inbound builder and the URI builder (verified live: Alice's N1 link is
  byte-identical to the pre-change seed expectation, her N2 user key is
  exactly the root key's 16-byte prefix)
- API: GET /api/customers/:id/credentials returns {credentials, bindings};
  regenerate is now POST /api/customers/:id/credentials/regenerate and
  rotates the whole set, rebuilding every deployed node of the customer
- UI: credentials pane shows the single shared set plus per-binding
  node/protocol/Reality-public-key rows
- golden subscriptions fixture regenerated under one shared set (RF and
  SS entries byte-identical to before; five entries audited by hand)
- golden baseline re-captured for the new shapes; difftest normalizer now
  treats a base64 root key's prefix-truncation encodings and the Surge
  '='-mangled variants as the same secret

public/app.js

@@ -636,19 +636,22 @@ function renderCredentialsPane(customer) {
   if (!customer) { pane.innerHTML = '<div class="empty"><b>创建客户后生成凭据</b></div>'; return; }
   const data = customerFormState.credentials;
   if (!data) { pane.innerHTML = '<div class="empty"><b>加载中…</b></div>'; return; }
-  const groups = data.items.map((entry) => `<div class="cred-group">
-    <div class="g-head">${esc(entry.nodeName)}<span class="badge ${entry.status === 'active' ? 'green' : 'gray'}">${esc(statusText[entry.status] || entry.status)}</span><span class="mut" style="font-weight:400;font-size:12px">${esc(entry.protocol)}</span>
-    <button type="button" class="icon-btn" style="margin-left:auto" data-tip="重新生成凭据" data-action="regen-credential" data-ncid="${esc(entry.nodeClientId)}" data-node="${esc(entry.nodeName)}">${ICONS.reset}</button></div>
-    ${credRowHTML('UUID', entry.clientId)}
-    ${credRowHTML('密码', entry.password)}
-    ${entry.shortId ? credRowHTML('Reality Short ID', entry.shortId) : ''}
+  const creds = data.credentials || {};
+  const bindings = (data.bindings || []).map((entry) => `<div class="cred-group">
+    <div class="g-head">${esc(entry.nodeName)}<span class="badge ${entry.status === 'active' ? 'green' : 'gray'}">${esc(statusText[entry.status] || entry.status)}</span><span class="mut" style="font-weight:400;font-size:12px">${esc(entry.protocol)}</span></div>
     ${entry.username ? credRowHTML('用户名', entry.username) : ''}
+    ${entry.realityPublicKey ? credRowHTML('Reality 公钥', entry.realityPublicKey) : ''}
   </div>`).join('');
   pane.innerHTML = `<div class="cred-group"><div class="g-head">订阅</div>
     <div class="cred-row"><span class="k">订阅令牌</span><span class="v">${esc(data.subscriptionToken || '—')}</span>
     <button type="button" class="icon-btn" data-tip="复制" data-action="copy-text" data-value="${esc(data.subscriptionToken || '')}">${ICONS.copy}</button>
     <button type="button" class="icon-btn" data-tip="重置订阅令牌" data-action="rotate-subscription" data-id="${esc(customer.id)}">${ICONS.reset}</button></div></div>
-    ${groups || '<div class="empty"><b>尚未关联节点</b></div>'}`;
+    <div class="cred-group"><div class="g-head">凭据（全部节点共用）<button type="button" class="icon-btn" style="margin-left:auto" data-tip="重新生成凭据" data-action="regen-credentials" data-id="${esc(customer.id)}">${ICONS.reset}</button></div>
+    ${credRowHTML('UUID', creds.clientId)}
+    ${credRowHTML('密码', creds.password)}
+    ${credRowHTML('Reality Short ID', creds.shortId)}
+    </div>
+    ${bindings || '<div class="empty"><b>尚未关联节点</b></div>'}`;
 }
 
 function linkStatusLine(customer, source) {
@@ -1147,11 +1150,10 @@ document.addEventListener('click', async (event) => {
         api(`/api/customers/${itemId}/credentials`).then((data) => { customerFormState.credentials = data; renderCredentialsPane(result.customer); }).catch(() => {});
       } else if (modalOpen()) subscriptionModal(result.customer);
     }
-    else if (action === 'regen-credential') {
+    else if (action === 'regen-credentials') {
       const customerId = $('#customer-form').dataset.customerId;
-      if (!await confirmModal(`重新生成「${button.dataset.node}」的凭据？该客户在此节点的现有连接将立即失效，需要重新导入订阅。`, '重新生成')) return;
-      await api(`/api/customers/${customerId}/credentials/${button.dataset.ncid}/regenerate`, { method: 'POST', body: '{}' });
-      const data = await api(`/api/customers/${customerId}/credentials`);
+      if (!await confirmModal('重新生成该客户的凭据？全部节点同时更换，现有连接将立即失效，需要重新导入订阅。', '重新生成')) return;
+      const data = await api(`/api/customers/${customerId}/credentials/regenerate`, { method: 'POST', body: '{}' });
       customerFormState.credentials = data;
       renderCredentialsPane(customerById(customerId));
       toast('凭据已重新生成');