fix: skip invalid proxy nodes during config build

[structName]

Summary

• preserve required TLS/SNI settings for Hysteria2 and TUIC Clash nodes
• decode Clash proxies independently so one malformed node does not discard the subscription
• validate candidate configs with the bundled sing-box kernel and exclude only attributable invalid nodes
• rebuild derived groups/routes after exclusion while keeping unrelated global config errors fatal
• validate before replacing the live config and before every desired-state recovery attempt

Verification

• pnpm run build
• go test -p 1 ./... -count=1
• fresh import of the reported subscription: 471 nodes, sing-box starts successfully
• injected unknown protocol is excluded while valid nodes remain available
• DIRECT and subscription-backed mixed inbound ports both returned HTTP 204 before and after restart