docs(us4): sing-box :6443 代理 + 根盘回收 91%→43% (Plane VPS-99/100)

新增独立 HTTPS forward proxy：Traefik 新 entrypoint proxyin(:6443) 终止 TLS，
后端 sing-box（HTTP inbound + users 认证 + direct 出站），与既有 :443
nghttpx/squid 链路并存。宿主机只新增 6443/tcp；容器不发布 host 端口。

新增 compose/sing-box/（镜像 digest 钉版）与两份 runbook：
- proxy-health.md：:443/:6443 只读健康检查，含开放代理负向测试
- proxy-client-setup.md：curl / env / 浏览器扩展配置与三类失败排查
  （407 无认证头、页面加载不全=CDN 域名漏配、urllib/wget 不支持 TLS-to-proxy）

同批根盘回收 91%→43%（约 14G）：rust/node/.go/podman 孤儿存储/apt/journal/
未用镜像/容器日志；journald 加 SystemMaxUse=200M；nghttpx+squid+traefik 加
json-file 轮转 10m×3；删除 ~/.cargo 后修好 zshenv/bashrc/profile 的失效 source。

验证：:6443 LE 证书、匿名 407、CONNECT 与绝对 URI 均返回 185.201.226.122；
us4-gate 401 / update 200 / trlm 302；8 容器全部 Up；validate-repo.sh PASS。

compose/sing-box/compose.yml

@@ -0,0 +1,47 @@
+# sing-box HTTP forward proxy on us4.wsvc.info, published through Traefik :6443.
+#
+# TLS terminates in Traefik (entrypoint `proxyin`); sing-box only speaks plain
+# HTTP-proxy on the private `proxy` Docker network, so it publishes NO host port.
+# The credential lives in the server-side ./config.json (mode 0600) and is never
+# committed here.
+#
+# Repo-owned copy of /opt/sing-box/compose.yml (static mechanism, not yet wired
+# to compose-deploy). Change record: Plane VPS-99. Health: runbooks/proxy-health.md.
+services:
+  sing-box:
+    image: ghcr.io/sagernet/sing-box:v1.14.2@sha256:afbffd294c5eb3519cc7b4587299ef189bb0a2ca2f667cb6301fdb6b9bce9558
+    container_name: sing-box
+    restart: unless-stopped
+    security_opt:
+      - no-new-privileges:true
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+    command:
+      - run
+      - -c
+      - /etc/sing-box/config.json
+    volumes:
+      - ./config.json:/etc/sing-box/config.json:ro
+    networks:
+      - proxy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=proxy"
+
+      # TCP router: TLS terminates here, decrypted bytes go to sing-box.
+      - "traefik.tcp.routers.singbox-proxy.rule=HostSNI(`us4.wsvc.info`)"
+      - "traefik.tcp.routers.singbox-proxy.entrypoints=proxyin"
+      - "traefik.tcp.routers.singbox-proxy.tls=true"
+      - "traefik.tcp.routers.singbox-proxy.tls.certresolver=letsencrypt"
+
+      # TCP service: in-container HTTP proxy port.
+      - "traefik.tcp.routers.singbox-proxy.service=singbox-proxy"
+      - "traefik.tcp.services.singbox-proxy.loadbalancer.server.port=8080"
+
+networks:
+  proxy:
+    name: proxy
+    external: true