Scope proxy-group selections per subscription and retire selectedNode

[madeye]

The bug

selectedNode held one global node name that the main app pushed into every non-bypass Selector group at tunnel start, and that ConfigManager.applySelectedNode() also promoted to index 0 of every such group in the effective YAML.

Nothing has written that key since node selection moved to the REST API (#23) — so the only values still in the wild are leftovers from older builds, a node name from a subscription the user may no longer even have.

When that stale name also existed in the current subscription, it passed the all.contains(name) membership check and got pinned into every group, routing all traffic through a node the user never picked. Observed with a leftover 🇨🇳 Taiwan 05 whose entry host was down: all 22 groups black-holed and it looked like the app couldn't handle the subscription at all, while the same config worked in standalone meow-rs (where a live node had been picked by hand).

It also raced replaySelectionsToEngine() and won — the global push runs on a 2s delay — so the user's real per-group choices were overwritten on every connect.

Two more issues in the same path

• applySelectedNode() was lossy. It round-tripped proxy-groups through the editable parser, which only understands name/type/proxies/url/interval. use:, filter:, lazy:, tolerance: and friends were silently dropped — emptying provider-backed groups for exactly the users who had the legacy key set.
• Cross-subscription contamination (the TODO(#75) item 6 in ProxyGroupsViewModel). proxyGroupSelections was keyed by group name alone, so two subscriptions sharing a group name and a node name replayed each other's picks.

The fix

• New Shared/ProxyGroupSelections.swift — selections keyed by subscription scope first, group name second. Stored as a plist dictionary (so defaults can still read/write it, which the E2E scripts rely on). Migrates the legacy unscoped blob into the active subscription and deletes selectedNode outright so it can never be pushed into a group again.
• selectSavedProxyNode() → replaySavedGroupSelections(): pushes only groups the user actually chose in, only with a value the group still lists. Engine-managed groups (URLTest, Fallback, …) are never pinned.
• applySelectedNode() removed — no config-time group rewriting at all. The engine starts each group on the config's own first member and the REST replay restores the user's choices, which is already how every post-Refactor proxy group management to use REST API #23 install behaves.
• updateGlobalProxyGroup / syncGlobalSelector use the user's own GLOBAL selection, and only when this config still defines that name (new configDefinesProxyName guard) — previously a stale name was listed blindly and the engine silently dropped it.
• Scopes swap on subscription switch; a deleted subscription's scope is forgotten.
• firstBypassMember dropped (its only callers are gone) along with its test suite; the shared recursion stays covered by the isBypassGroup tests.

Testing

• swiftlint lint --strict — 0 violations.
• xcodebuild test -only-testing:BaoLianDengTests — 213 tests, all pass except HTTP request through SOCKS5 proxy, which fails identically on main (network-dependent, curl exit 28).
• New ProxyGroupSelectionsTests covers scoping, scope removal, both legacy migrations, and malformed storage.
• E2E scripts updated to write the scoped key instead of selectedNode.