feat(sub): export TLS cipher suites as the cs query param in share links (#6825)

Hosts and TLS inbounds can set cipher suites, but they reached only the JSON and
Clash subscriptions; raw share links never carried them, so clients that read cs
from links (v2rayNG forks used with fp=unsafe) had to enter them by hand. Share
links now emit cs from the host or inbound TLS settings, the panel's own link
generator and previews do the same, and both link parsers (the Go one and the
panel's outbound import) read cs back into tlsSettings.cipherSuites.

internal/sub/service.go

@@ -1867,6 +1867,11 @@ func applyShareTLSParams(stream map[string]any, params map[string]string) {
 		if pins, ok := pinnedSha256List(tlsSettings); ok {
 			params["pcs"] = strings.Join(pins, ",")
 		}
+		if csValue, ok := searchKey(tlsSetting, "cipherSuites"); ok {
+			if cs, _ := csValue.(string); cs != "" {
+				params["cs"] = cs
+			}
+		}
 	}
 }
 
@@ -1902,6 +1907,11 @@ func applyVmessTLSParams(stream map[string]any, obj map[string]any) {
 		if pins, ok := pinnedSha256List(tlsSettings); ok {
 			obj["pcs"] = strings.Join(pins, ",")
 		}
+		if csValue, ok := searchKey(tlsSetting, "cipherSuites"); ok {
+			if cs, _ := csValue.(string); cs != "" {
+				obj["cs"] = cs
+			}
+		}
 	}
 }
 
@@ -2048,7 +2058,7 @@ func buildVmessLink(obj map[string]any) string {
 func cloneVmessShareObj(baseObj map[string]any, newSecurity string) map[string]any {
 	newObj := map[string]any{}
 	for key, value := range baseObj {
-		if newSecurity != "none" || (key != "alpn" && key != "sni" && key != "fp" && key != "pcs") {
+		if newSecurity != "none" || (key != "alpn" && key != "sni" && key != "fp" && key != "pcs" && key != "cs") {
 			newObj[key] = value
 		}
 	}
@@ -2077,6 +2087,9 @@ func applyExternalProxyTLSObj(ep map[string]any, obj map[string]any, security st
 	if ech, ok := ep["echConfigList"].(string); ok && ech != "" {
 		obj["ech"] = ech
 	}
+	if cs, ok := externalProxyCipherSuites(ep); ok {
+		obj["cs"] = cs
+	}
 }
 
 func applyExternalProxyTLSParams(ep map[string]any, params map[string]string, security string) {
@@ -2101,6 +2114,9 @@ func applyExternalProxyTLSParams(ep map[string]any, params map[string]string, se
 	if ech, ok := ep["echConfigList"].(string); ok && ech != "" {
 		params["ech"] = ech
 	}
+	if cs, ok := externalProxyCipherSuites(ep); ok {
+		params["cs"] = cs
+	}
 }
 
 // applyExternalProxyHysteriaParams overrides the cert pin for a single
@@ -2211,6 +2227,13 @@ func applyExternalProxyTLSToStream(ep map[string]any, stream map[string]any, sec
 	}
 }
 
+func externalProxyCipherSuites(ep map[string]any) (string, bool) {
+	if cs, ok := ep["cipherSuites"].(string); ok && cs != "" {
+		return cs, true
+	}
+	return "", false
+}
+
 func externalProxySNI(ep map[string]any) (string, bool) {
 	if sni, ok := ep["sni"].(string); ok && sni != "" {
 		return sni, true
@@ -2357,7 +2380,7 @@ func appendQueryAndFragment(link string, params map[string]string, fragment, sec
 			if securityOverride != "" && k == "security" {
 				v = securityOverride
 			}
-			if omitTLSFields && (k == "alpn" || k == "sni" || k == "fp" || k == "pcs") {
+			if omitTLSFields && (k == "alpn" || k == "sni" || k == "fp" || k == "pcs" || k == "cs") {
 				continue
 			}
 			q.Set(k, v)

internal/sub/service_test.go

@@ -830,6 +830,35 @@ func TestApplyExternalProxyTLSParams_SetsPinnedPeerCert(t *testing.T) {
 	}
 }
 
+func TestApplyExternalProxyTLSParams_SetsCipherSuites(t *testing.T) {
+	params := map[string]string{"security": "tls"}
+	ep := map[string]any{
+		"dest":         "proxy.example.com",
+		"cipherSuites": "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256",
+	}
+
+	applyExternalProxyTLSParams(ep, params, "tls")
+
+	if params["cs"] != "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256" {
+		t.Fatalf("cs = %q, want TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256", params["cs"])
+	}
+}
+
+func TestApplyShareTLSParams_SetsCipherSuites(t *testing.T) {
+	stream := map[string]any{
+		"security": "tls",
+		"tlsSettings": map[string]any{
+			"cipherSuites": "TLS_AES_128_GCM_SHA256",
+		},
+	}
+	params := map[string]string{}
+	applyShareTLSParams(stream, params)
+
+	if params["cs"] != "TLS_AES_128_GCM_SHA256" {
+		t.Fatalf("cs = %q, want TLS_AES_128_GCM_SHA256", params["cs"])
+	}
+}
+
 func TestApplyExternalProxyTLSObj_SetsPinnedPeerCert(t *testing.T) {
 	obj := map[string]any{"tls": "tls"}
 	ep := map[string]any{