feat: 新增 GRE 隧道协议，管理端口调整为 18080

- backend: 新增 GRE 隧道实现（ip tunnel 点对点互联），binmgr 支持 iproute2
- backend: api/identity 调整，各协议 service（gre/ikev2/ipsec/l2tp/openvpn）统一改动
- backend: OpenVPN 认证辅助与用户口令同步逻辑完善
- frontend: 协议图标/向导/编辑器支持 GRE，VPN 用户页重构（234 行）
- frontend: 新增 RouteListInput 路由列表输入组件，Dashboard/Layout 优化
- i18n: 中英文文案同步更新
- test: 新增 binmgr/common/gre 单测，openvpn 测试补充
- docs: README 补充 GRE 说明，默认监听端口 8080 → 18080
- chore: .gitignore 增加 opsx-vpn.previous（构建备份二进制）

backend/internal/service/openvpn/openvpn_test.go

@@ -16,9 +16,12 @@ func TestValidateOpenVPNModes(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if cfg["proto"] != "udp" || cfg["port"] != 1194 {
+	if cfg["proto"] != "tcp-server" || cfg["port"] != 1194 || cfg["auth_mode"] != "password" {
 		t.Fatalf("defaults not applied: %#v", cfg)
 	}
+	if cfg["enable_nat"] != true {
+		t.Fatalf("NAT should default to enabled: %#v", cfg)
+	}
 	if _, err := New().Validate(map[string]interface{}{"auth_mode": "unknown"}); err == nil {
 		t.Fatal("expected invalid auth mode error")
 	}
@@ -31,7 +34,7 @@ func TestValidateOpenVPNModes(t *testing.T) {
 		t.Fatalf("tcp not normalized: %#v", cfg2)
 	}
 	cfg3, err := New().Validate(map[string]interface{}{
-		"subnet": "10.8.0.0 255.255.255.0", "push_routes": "192.168.1.0/24",
+		"subnet": "10.8.0.0 255.255.255.0", "push_routes": "# VPC\n192.168.1.0/24\n# staging\n10.0.0.10",
 	})
 	if err != nil {
 		t.Fatal(err)
@@ -39,6 +42,12 @@ func TestValidateOpenVPNModes(t *testing.T) {
 	if cfg3["redirect_gateway"] != false {
 		t.Fatalf("push_routes should default redirect_gateway off: %#v", cfg3)
 	}
+	if cfg3["push_routes"] != "# VPC\n192.168.1.0/24\n# staging\n10.0.0.10/32" {
+		t.Fatalf("push_routes not normalized: %#v", cfg3)
+	}
+	if _, err := New().Validate(map[string]interface{}{"subnet": "10.8.0.0 255.255.255.0", "push_routes": "10.0.0.999"}); err == nil {
+		t.Fatal("expected invalid route to fail")
+	}
 	// MFA 仅允许密码相关模式
 	if _, err := New().Validate(map[string]interface{}{
 		"auth_mode": "certificate", "mfa_mode": "required", "subnet": "10.8.0.0 255.255.255.0",
@@ -102,6 +111,7 @@ func TestServerConfigIncludesProductionTunings(t *testing.T) {
 		"max-clients 1000",
 		"duplicate-cn",
 		"via-file",
+		"data-ciphers-fallback AES-256-GCM",
 	} {
 		if !strings.Contains(raw, want) {
 			t.Fatalf("server.conf missing %q\n%s", want, raw)
@@ -110,6 +120,11 @@ func TestServerConfigIncludesProductionTunings(t *testing.T) {
 	if strings.Contains(raw, "via-env") {
 		t.Fatal("should use via-file not via-env")
 	}
+	for _, obsolete := range []string{"persist-key", "ifconfig-pool-persist"} {
+		if strings.Contains(raw, obsolete) {
+			t.Fatalf("server.conf should not contain obsolete %q\n%s", obsolete, raw)
+		}
+	}
 }
 
 func TestValidateTOTPSkew(t *testing.T) {
@@ -134,3 +149,26 @@ func TestCertificateCNIsSafeAndStable(t *testing.T) {
 		t.Fatalf("unsafe CN: %q", cn)
 	}
 }
+
+func TestPKIScriptUses99YearCertificates(t *testing.T) {
+	script := pkiScript(&model.Tunnel{ID: 1, Protocol: "openvpn"})
+	for _, want := range []string{"EASYRSA_CA_EXPIRE=36135", "EASYRSA_CERT_EXPIRE=36135"} {
+		if !strings.Contains(script, want) {
+			t.Fatalf("PKI script missing %q\n%s", want, script)
+		}
+	}
+	if !strings.Contains(script, "EASYRSA_REQ_CN=OPSX-VPN-CA") {
+		t.Fatalf("PKI script should set a CA name: %s", script)
+	}
+	if strings.Contains(script, "export EASYRSA_BATCH=1 EASYRSA_REQ_CN") {
+		t.Fatalf("PKI script must not export the CA CN to server/client certificate commands: %s", script)
+	}
+}
+
+func TestSplitStatusFieldsSupportsOpenVPNStatusV3(t *testing.T) {
+	line := "CLIENT_LIST\tadmin\ttcp4-server:203.0.113.1:1194\t10.8.0.2\t\t7161451\t8489433\t2026-07-25 23:32:58\t1784993578\tadmin"
+	fields := splitStatusFields(line)
+	if len(fields) != 10 || fields[5] != "7161451" || fields[9] != "admin" {
+		t.Fatalf("status-version 3 fields parsed incorrectly: %#v", fields)
+	}
+}