feat: 增量升级路径 --upgrade / --ui-only

- 已装机器默认自动走升级，保留 secret/网卡/账密
- 默认不重下 sing-box、不 rebind、不 verify
- scripts/upgrade.sh + install.sh 入口 + README

cpxy

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")" && pwd)"
+cmd="${1:-help}"
+shift || true
+case "$cmd" in
+  detect)   exec "$ROOT/scripts/detect.sh" "$@" ;;
+  generate) exec "$ROOT/scripts/generate.sh" "$@" ;;
+  install)  exec "$ROOT/scripts/install.sh" "$@" ;;
+  upgrade)  exec "$ROOT/scripts/upgrade.sh" "$@" ;;
+  verify)   exec "$ROOT/scripts/verify.sh" "$@" ;;
+  fetch)    exec "$ROOT/scripts/fetch-binaries.sh" "$@" ;;
+  auth)     exec "$ROOT/scripts/apply-proxy-auth.sh" "$@" ;;
+  help|*)
+    cat <<H
+./cpxy <cmd>
+  detect | generate | install | upgrade | verify | fetch
+  auth --user U --pass P | auth --clear | auth --show
+
+语义: 走本代理的连接一律从数据网卡出口（系统默认仍可走 WiFi）
+
+在线增量升级:
+  curl -fsSL 'https://gitea.chickliu.fun/Hermes/cellular-proxy/raw/branch/main/install.sh' | sudo bash -s -- --upgrade
+H
+    ;;
+esac