Introduce internal/export as the single cert/SNI/skip-cert resolver.
ClientURIs, DecodeNodeModel, resolveShareTLS and Clash proxy TLS helpers
all consume BuildProfileFromConfig so formal IP certs always emit sni and
subscriptions no longer diverge from share links on certificate identity.