fix(detect): never bind USB gadget iface as proxy egress

设备把自己当 USB 网卡挂给上游主机时会出现 usb0（驱动 configfs-gadget.g1，
IP 192.168.68.1）。该链路只通向 PC，被当成出口后所有出站都 context
deadline exceeded，客户端看到 socks connect failed rep=0x01。

误选原因：score_iface_as_cellular 给 usb0 与真出口 wwan0 都打 175 分。
usb0 靠名称命中 patterns 里的 usb（+80）与非默认路由（+40）；wwan0 的
bam-dmux 驱动不在白名单里，白丢 +100。detect_cellular_iface 用 -gt 比较，
list_ifaces 按名排序让 usb0 先入选，平分下无法被顶替。

改动：
- lib.sh 新增 iface_is_usb_gadget()，按驱动名与 gadget 总线路径识别，
  并并入 is_virtual_or_skip_iface（usb0 评分 175 -> 0）
- 驱动白名单补 bam-dmux/bam_dmux/qcom-ipa/ipa_wan；名称权重 80 -> 40，
  确保驱动证据始终压过名称猜测
- 新增 detect_cellular_iface_via_mm()，把 ModemManager bearer 的
  interface: 作为第 0 步权威来源
- detect_cellular_iface / resolve_cellular 全链路拒绝 gadget 网卡，
  取不到真出口时按 REQUIRE_CELLULAR_IFACE 直接失败而不是绑错
- generate/install/upgrade/watch/detect/verify 各入口独立设闸，
  verify.sh 发现出口是 gadget 时直接 exit 4 并给出修复命令
- 默认 CELLULAR_IFACE_PATTERNS 去掉 usb/enx；upgrade.sh 与根 install.sh
  就地迁移已有 settings.conf，旧机器升级即修复
- 新增 tests/detect-gadget.sh：18 条离线断言，无需真机

scripts/upgrade.sh

@@ -82,6 +82,33 @@ info "======== cellular-proxy 增量升级 ========"
 info "安装目录: $INSTALL_DIR"
 info "配置文件: $CONFIG_FILE（将保留密钥/网卡/账密）"
 
+# --- 迁移：老配置里的 usb/enx 关键词会把 USB gadget 网卡（usb0）当数据出口 ---
+# 升级保留 settings.conf，因此必须在这里就地清理，否则旧机器升级后仍会误绑。
+migrate_iface_patterns() {
+  local conf="$1" cur cleaned tmp
+  [[ -f "$conf" ]] || return 0
+  cur="$(awk -F= '/^CELLULAR_IFACE_PATTERNS=/{print substr($0,index($0,"=")+1); exit}' "$conf" 2>/dev/null || true)"
+  [[ -n "$cur" ]] || return 0
+  cleaned="$(printf '%s' "$cur" | tr ',' '\n' | sed 's/[[:space:]]//g' \
+    | grep -vxE 'usb|enx' | paste -sd, - 2>/dev/null || true)"
+  [[ -n "$cleaned" && "$cleaned" != "$cur" ]] || return 0
+  tmp="$(mktemp)"
+  awk -v v="$cleaned" '
+    /^CELLULAR_IFACE_PATTERNS=/ { print "CELLULAR_IFACE_PATTERNS=" v; next }
+    { print }
+  ' "$conf" > "$tmp"
+  mv "$tmp" "$conf"
+  warn "已从 CELLULAR_IFACE_PATTERNS 移除 usb/enx（会误命中 USB gadget 网卡）: $cur -> $cleaned"
+  CELLULAR_IFACE_PATTERNS="$cleaned"
+}
+migrate_iface_patterns "$CONFIG_FILE"
+
+# 迁移：已写死 gadget 网卡的旧配置，清空后走重新探测
+if [[ -n "${CELLULAR_IFACE:-}" ]] && iface_is_usb_gadget "${CELLULAR_IFACE:-}"; then
+  warn "旧配置 CELLULAR_IFACE=$CELLULAR_IFACE 是 USB gadget 网卡，将重新探测数据出口"
+  CELLULAR_IFACE=""
+fi
+
 ensure_dirs
 mkdir -p /var/lib/cellular-proxy "$INSTALL_DIR/bin" "$INSTALL_DIR/etc" "$INSTALL_DIR/ui" "$INSTALL_DIR/scripts" "$INSTALL_DIR/generated"
 
@@ -104,6 +131,7 @@ if [[ "$DO_REBIND" == "true" ]]; then
   info "重新探测数据网卡…"
   cell="$(detect_cellular_iface "" || true)"
   [[ -n "$cell" ]] || die "未能探测数据网卡"
+  ! iface_is_usb_gadget "$cell" || die "探测到的 $cell 是 USB gadget 网卡（面向上游主机），不能作为数据出口"
   src="$(detect_source_ip "$cell" || true)"
   persist_cellular_to_settings "$CONFIG_FILE" "$cell" "$src"
   load_config
@@ -113,10 +141,14 @@ if [[ "$DO_REBIND" == "true" ]]; then
 fi
 
 cell="${CELLULAR_IFACE:-}"
-if [[ -z "$cell" ]] || ! iface_exists "$cell"; then
-  warn "配置中的 CELLULAR_IFACE=${cell:-空} 无效，尝试自动探测（仅本次）"
+if [[ -z "$cell" ]] || ! iface_exists "$cell" || iface_is_usb_gadget "$cell"; then
+  if [[ -n "$cell" ]] && iface_is_usb_gadget "$cell"; then
+    warn "配置中的 CELLULAR_IFACE=$cell 是 USB gadget 网卡，不能作为出口，重新探测"
+  else
+    warn "配置中的 CELLULAR_IFACE=${cell:-空} 无效，尝试自动探测（仅本次）"
+  fi
   cell="$(detect_cellular_iface "" || true)"
-  if [[ -n "$cell" ]]; then
+  if [[ -n "$cell" ]] && ! iface_is_usb_gadget "$cell"; then
     src="$(detect_source_ip "$cell" || true)"
     persist_cellular_to_settings "$CONFIG_FILE" "$cell" "$src"
     load_config
@@ -223,9 +255,12 @@ case "$cmd" in
     # shellcheck source=/dev/null
     source "$BASE/scripts/lib.sh"
     load_config
-    if [[ -z "${CELLULAR_IFACE:-}" ]] || ! iface_exists "${CELLULAR_IFACE:-}"; then
+    if [[ -z "${CELLULAR_IFACE:-}" ]] || ! iface_exists "${CELLULAR_IFACE:-}" || iface_is_usb_gadget "${CELLULAR_IFACE:-}"; then
+      if [[ -n "${CELLULAR_IFACE:-}" ]] && iface_is_usb_gadget "${CELLULAR_IFACE:-}"; then
+        warn "CELLULAR_IFACE=$CELLULAR_IFACE 是 USB gadget 网卡，重新探测"
+      fi
       cell="$(detect_cellular_iface "" || true)"
-      if [[ -n "$cell" ]]; then
+      if [[ -n "$cell" ]] && ! iface_is_usb_gadget "$cell"; then
         src="$(detect_source_ip "$cell" || true)"
         persist_cellular_to_settings "$CONFIG_FILE" "$cell" "$src"
         CELLULAR_IFACE="$cell"
@@ -254,6 +289,7 @@ case "$cmd" in
     load_config
     cell="$(detect_cellular_iface "" || true)"
     [[ -n "$cell" ]] || die "未能探测数据网卡"
+    ! iface_is_usb_gadget "$cell" || die "探测到的 $cell 是 USB gadget 网卡，不能作为数据出口"
     src="$(detect_source_ip "$cell" || true)"
     persist_cellular_to_settings "$CONFIG_FILE" "$cell" "$src"
     info "已重新绑定 $cell src=${src:-}"