Add priority outbound group

[Shooa]

What

Adds a new outbound group type, priority, that picks an outbound by tiers instead of by latency.

Why

I run a gateway with several exits in different locations. With urltest the group always lands on whatever has the lowest RTT, which isn't what I want there — I have a preferred exit (or a couple of preferred ones) and the rest are only meant as fallback. urltest happily parks traffic on a far-away node just because it answered the probe a few ms faster, and tolerance doesn't really solve it once the delta is large.

What I actually want is "stay on tier 1 as long as anything in it works; if the whole tier dies, fall to tier 2; come back up when tier 1 is healthy again." That's the classic fallback behaviour from Clash/mihomo that sing-box doesn't have a direct equivalent for, so I wrote it as a small group on top of the existing urltest machinery.

Behaviour

{
  "type": "priority",
  "tag": "proxy",
  "tiers": [
    ["nl-reality", "nl-hy2"],
    ["de-reality", "de-hy2"],
    ["us-reality", "us-hy2"]
  ],
  "url": "https://www.gstatic.com/generate_204",
  "interval": "3m",
  "tier_up_checks": 2,
  "tier_down_checks": 1
}

• Holds the highest tier that still has at least one healthy member.
• Within the active tier it behaves exactly like urltest (lowest delay + tolerance), so you can spread load across equivalent exits in the same tier.
• Drops to a lower tier only after the active tier has been fully down for tier_down_checks consecutive rounds (default 1).
• Climbs back up after a higher tier has been healthy for tier_up_checks consecutive rounds (default 2) — the hysteresis keeps a flapping upstream from bouncing the selection every probe.
• TCP and UDP track their tier independently, same as urltest.

Probing, the history store, clash_api reporting and connection interruption are all reused from urltest, so it shows up in the dashboard/API like any other group with no extra wiring.

Notes

• One new file (protocol/group/priority.go) plus the usual registration touch-points and a docs page.
• The tier transition policy is pulled out into a pure function and covered by a table-driven test (priority_test.go) — cold start, drop, delayed drop, climb-back, flap suppression.
• I also tested it end-to-end in a container: three tiers wired to local socks upstreams, killing/restoring them with nft and watching the active member flip through clash_api. Drops and climb-back behave as expected.
• golangci-lint run is clean for linux/windows/android and go test ./protocol/group/... passes.

Happy to adjust naming/defaults if you'd prefer something different.