Fix SS connector error propagation and SIP002 base64 auth decoding

[juev]

Summary

• Fix nil pointer dereference panic in SS TCP/UDP connectors when cipher initialization fails — Init was returning nil instead of err from NewClientConfig, causing WrapConn to crash on a nil client
• Add SIP002 URI format support (ss://BASE64(method:password)@host:port) for command-line -L/-F flags, with RawURLEncoding and StdEncoding fallback
• Initialize tcpClient in UDP connector for the UDP-over-TCP code path

Problem

When using gost with a SIP002-style Shadowsocks URI:

gost -F 'ss://YWVzLTI1Ni1nY206cGFzc3dvcmQ@server:8388'

Two issues occur:

1. The base64-encoded userinfo (YWVzLTI1Ni1nY206cGFzc3dvcmQ = aes-256-gcm:password) is passed as-is to the cipher, which fails silently because Init returns nil instead of the error
2. Even if the cipher were valid, the URL parser treats the entire base64 string as a username (no : separator in the raw URL), so method and password are never extracted

Changes

connector/ss/connector.go, connector/ss/udp/connector.go

• Return err instead of nil when NewClientConfig fails
• Initialize tcpClient in UDP connector

config/cmd/cmd.go

• Add decodeSIP002Auth() — detects SIP002 format (userinfo without password), decodes base64 (RawURLEncoding with StdEncoding fallback), splits on : into method and password
• Update buildServiceConfig and buildNodeConfig to try SIP002 decoding for ss* schemes before falling back to standard userinfo
• Update parseAuthFromCmd to try RawURLEncoding before StdEncoding

config/cmd/cmd_test.go (new)

• Unit tests for decodeSIP002Auth and parseAuthFromCmd
• Integration tests for buildNodeConfig and buildServiceConfig with both SIP002 and standard auth formats

Test plan

• go build ./...
• go test -v -race -count=1 ./...
• Functional test: gost -L :1080 -F 'ss://YWVzLTI1Ni1nY206cGFzc3dvcmQ@127.0.0.1:8388' starts without panic

---

Closed: go-gost/gost#843