* feat(sub): add legacy Clash subscription endpoint
* fix(deps): update js-yaml to patched release
Raise the Swagger UI js-yaml override to 4.3.2 and refresh the lockfile to resolve GHSA-2883-xcg3-v3hh without changing Swagger UI.
* fix(sub): preserve client detection and normalize legacy cipher
Keep the original Clash/Mihomo auto-detection default so existing subscription URLs continue returning YAML. Normalize the panel-supported chacha20-poly1305 alias when generating legacy Clash profiles, and cover both regressions through HTTP endpoint tests.
* refactor(sub): drop an unreachable guard and make the alias test assert
Review of the legacy Clash subscription endpoint left three LOW findings, all
introduced by the change:
- The comment above the routing merge ran to three lines, over CLAUDE.md's
two-line cap.
- validateClashRouteGraph on the legacy path could never fail: the legacy
branch skips the routing merge, so it validated the literal config built a
few lines above against itself. Dead code that reads as a guard.
- TestClashAliasesSkipConfiguredPathConflicts asserted nothing — it could only
fail on an escaping gin panic, so a regression that registered the alias
handler on the configured path went unnoticed. It now drives each collision
through the router and asserts which format answers each path.
---------
Co-authored-by: Sanaei <ho3ein.sanaei@gmail.com>
64b6e43e2b