Release 2.7.3.1: harden proxy recovery, updates and local API.

Restore orphaned system proxy after crash, require update SHA-256, add macOS /api auth token, fix UDP ping false positives, HTTPS-only subscriptions, and keep the UI responsive during connect.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/subscription/fetch.go

@@ -27,7 +27,6 @@ type Item struct {
 
 var (
 	reShareLine = regexp.MustCompile(`(?i)((?:hysteria2|hy2|vless|vmess|trojan|awg|amneziawg|wireguard|naive\+https|naive\+quic|naive|quic|https|http)://[^\s"'<>]+)`)
-	reClashHY2  = regexp.MustCompile(`(?is)type:\s*hysteria2\b.*?server:\s*(\S+).*?port:\s*(\d+).*?(?:password|auth):\s*["']?([^\s"']+)`)
 )
 
 // Fetch downloads a subscription body and parses proxy share links.
@@ -37,8 +36,8 @@ func Fetch(ctx context.Context, rawURL string) ([]Item, error) {
 		return nil, fmt.Errorf("пустой URL подписки")
 	}
 	u, err := url.Parse(rawURL)
-	if err != nil || (u.Scheme != "http" && u.Scheme != "https") {
-		return nil, fmt.Errorf("нужен http(s) URL подписки")
+	if err != nil || u.Scheme != "https" {
+		return nil, fmt.Errorf("нужен https URL подписки")
 	}
 
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, rawURL, nil)
@@ -219,7 +218,6 @@ func extractClashHY2(text string) []string {
 		}
 		out = append(out, link)
 	}
-	_ = reClashHY2 // kept for possible future tightening
 	return out
 }