feat(overlay): 覆盖网络线序①–⑮ 代码与测试产物入库

覆盖网络线累积产物（此前只在工作区、未入版本库）：
- 新增 relay 子系统 src/net/relay/**（wire/duplex/server/client/dialer/switcher/directory/identity/keys/placement/network/addr-override/main/index）
- 新增 src/worker/relay-tunnel.ts、src/web/routes/overlay.ts
- 新增观测/演练脚本 overlay-probe、overlay-failover-drill、overlay-keyring、overlay-holepunch、overlay-jitter、overlay-wan、overlay-relaykey-add、relay-mem-calibrate
- 新增测试 12 个（relay / relay-failover / remote-spawner / instance-port / overlay-{network,auth,bootstrap,identity} / remote-user-fs 等）

验收基线：npm test = 162 pass / 0 fail / 1 skip；--scene all = 12 PASS / 0 SKIP / 0 FAIL；overlay-probe = 12/12

src/db/repo.ts

@@ -595,19 +595,36 @@ export function deleteBusinessPlugin(db: Database, id: string): boolean {
 // ⚠️ local 模式**不调用**这些函数（`LocalSpawner` 靠进程内 Map + 单机互斥），
 //    所以它们的存在不会改变现有单机行为。
 
-const HOST_COLS = 'id, endpoint, agent_token, capacity_mb, used_mb, status, last_heartbeat'
+const HOST_COLS = 'id, endpoint, via, network_id, agent_token, capacity_mb, used_mb, status, last_heartbeat'
 
-/** 注册/更新一台 worker。join 幂等：同 id 重复执行 = 更新（并把它标回 `up`）。 */
+/** 注册/更新一台 worker。join 幂等：同 id 重复执行 = 更新（并把它标回 `up`）。
+ *
+ * ⚠️ `via` 与 `networkId` **省略时不覆盖已有值**（`COALESCE` 到旧值）：否则一次不带它们的
+ * join 会把回填好的 `local` / 已划定的网络归属冲回列默认值（那种漂移在换中继、建第二张网之前
+ * **看不出症状**）。
+ */
 export function upsertDshHost(db: Database, input: UpsertDshHostInput): DshHost {
   prepare(db, `
-    INSERT INTO dsh_hosts (id, endpoint, agent_token, capacity_mb, used_mb, status, last_heartbeat)
-    VALUES (?, ?, ?, ?, 0, ?, NULL)
+    INSERT INTO dsh_hosts (id, endpoint, via, network_id, agent_token, capacity_mb, used_mb, status, last_heartbeat)
+    VALUES (?, ?, COALESCE(?, 'manager-ssh'), COALESCE(?, 'ops'), ?, ?, 0, ?, NULL)
     ON CONFLICT(id) DO UPDATE SET
       endpoint    = excluded.endpoint,
+      via         = COALESCE(?, dsh_hosts.via),
+      network_id  = COALESCE(?, dsh_hosts.network_id),
       agent_token = excluded.agent_token,
       capacity_mb = excluded.capacity_mb,
       status      = excluded.status
-  `).run(input.id, input.endpoint, input.agentToken, input.capacityMb, input.status ?? 'up')
+  `).run(
+    input.id,
+    input.endpoint,
+    input.via ?? null,
+    input.networkId ?? null,
+    input.agentToken,
+    input.capacityMb,
+    input.status ?? 'up',
+    input.via ?? null,
+    input.networkId ?? null,
+  )
   const row = prepare(db, `SELECT ${HOST_COLS} FROM dsh_hosts WHERE id = ?`).get(input.id)
   return toDshHost(row as Record<string, unknown>)
 }