fix(ss): propagate cipher errors and decode SIP002 base64 auth

- Return err instead of nil in SS TCP/UDP connector Init when
  NewClientConfig fails, preventing nil pointer dereference in WrapConn
- Initialize tcpClient in UDP connector for UDP-over-TCP path
- Add decodeSIP002Auth to handle ss://BASE64(method:password)@host:port
  URL format with RawURLEncoding and StdEncoding fallback
- Update buildServiceConfig and buildNodeConfig to decode SIP002 auth
  for ss* schemes before falling back to standard userinfo parsing
- Support RawURLEncoding in parseAuthFromCmd with StdEncoding fallback
- Add tests for decodeSIP002Auth, parseAuthFromCmd, and integration
  tests for buildNodeConfig/buildServiceConfig

connector/ss/udp/connector.go

@@ -51,9 +51,10 @@ func (c *ssuConnector) Init(md md.Metadata) (err error) {
 		password, _ := c.options.Auth.Password()
 		clientConfig, err := utils.NewClientConfig(method, password)
 		if err != nil {
-			return nil
+			return err
 		}
 		c.client = core.NewUDPClient(clientConfig, 60)
+		c.tcpClient = core.NewTCPClient(clientConfig)
 	}
 
 	return