fix(sub): drop external Clash shadowsocks nodes the panel cannot express (#6508)

* fix(sub): gate external Clash shadowsocks links like the inbound path

clashProxyFromExternal returned as soon as it had built the ss proxy, so an
ss:// link skipped applyTransport/applySecurity: a node whose tcp/http
obfuscation Clash cannot express was emitted anyway (mihomo then opens a plain
shadowsocks stream at a server that requires the header, and the node silently
never connects), and security=tls was silently stripped. The inbound path runs
both helpers for every protocol, so the two Clash importers disagreed about the
same node.

* fix(sub): count a dropped external link in the quota header

The client email that feeds AggregateTrafficByEmails was recorded only when a
proxy came out of the link, so a node Clash cannot represent also vanished from
the Subscription-Userinfo header of every other node in the same subscription —
the header reported another client's numbers as the whole subscription's. The
inactive-link branch already counted an email without a proxy; make that
unconditional so the header describes the subscribers, not the representable
subset of their nodes.

* docs(sub): describe clashProxyFromExternal by what it does, not by protocol

The protocol list in the doc comment went stale the moment the shadowsocks
branch stopped returning early, and it restated what the switch already says.

internal/sub/clash_external.go

@@ -6,11 +6,8 @@ import (
 	"strings"
 )
 
-// clashProxyFromExternal parses a pasted share link and converts it into a
-// mihomo/Clash proxy entry named `name`. Returns nil for links Clash can't
-// represent (the entry is then skipped, mirroring how getProxies drops
-// unsupported inbound protocols). vmess/vless/trojan reuse the existing
-// applyTransport/applySecurity helpers; ss/hysteria2/wireguard map directly.
+// clashProxyFromExternal converts a pasted share link into a mihomo/Clash proxy
+// entry, or nil when Clash can't represent it — the same gate getProxies runs.
 func (s *SubClashService) clashProxyFromExternal(rawLink, name string) map[string]any {
 	ob := parseExternalLink(rawLink)
 	if ob == nil {
@@ -81,7 +78,8 @@ func (s *SubClashService) clashProxyFromExternal(rawLink, name string) map[strin
 		proxy["port"] = clashInt(server["port"])
 		proxy["cipher"] = method
 		proxy["password"] = fmt.Sprint(server["password"])
-		return proxy
+		// No early return: the shared transport/security tail is what drops an
+		// obfs node Clash cannot express, exactly as buildProxy does for inbounds.
 	case "hysteria":
 		return clashHysteriaFromExternal(settings, stream, name)
 	case "wireguard":