chore: 恢复旧布局基线（迁移改动丢失后重建，apps/packages 布局暂存）

server/internal/db/ssh_tunnel_test.go

@@ -0,0 +1,36 @@
+package db
+
+import "testing"
+
+// R2-B1:SSH 隧道改写 Host 后,TLS ServerName 必须保留原 Host(隧道内 TLS 校验依赖)。
+func TestRewriteHostForTunnelPreservesServerName(t *testing.T) {
+	c := ConnReq{Host: "db.internal", Port: 3306, SSHEnabled: true}
+	out := rewriteHostForTunnel(c, 45678)
+	if out.Host != "127.0.0.1" || out.Port != 45678 {
+		t.Fatalf("隧道地址改写错误: %s:%d", out.Host, out.Port)
+	}
+	if out.SSHEnabled {
+		t.Fatal("SSHEnabled 应置 false,防嵌套隧道")
+	}
+	if out.TLSServerName != "db.internal" {
+		t.Fatalf("TLSServerName 应保留原 Host, got %q", out.TLSServerName)
+	}
+}
+
+// 用户显式指定 tlsServerName 时,隧道改写不得覆盖。
+func TestRewriteHostForTunnelKeepsExplicitServerName(t *testing.T) {
+	c := ConnReq{Host: "db.internal", TLSServerName: "db.example.com", SSHEnabled: true}
+	out := rewriteHostForTunnel(c, 40001)
+	if out.TLSServerName != "db.example.com" {
+		t.Fatalf("显式 TLSServerName 应保留, got %q", out.TLSServerName)
+	}
+}
+
+func TestTLSServerNameFor(t *testing.T) {
+	if got := tlsServerNameFor(ConnReq{Host: "db.example"}); got != "db.example" {
+		t.Fatalf("空 tlsserverName 应用 Host, got %q", got)
+	}
+	if got := tlsServerNameFor(ConnReq{Host: "127.0.0.1", TLSServerName: "db.example"}); got != "db.example" {
+		t.Fatalf("显式 tlsserverName 优先, got %q", got)
+	}
+}