feat: mihomo YAML subscription support + flow/fingerprint passthrough

- fetcher: parse mihomo/clash.meta YAML subscriptions (proxies: list),
  auto-detect format (mihomo YAML vs plain vless:// lines)
- config_builder: forward VLESS flow (xtls-rprx-vision) and per-node
  uTLS fingerprint to sing-box (required for Reality+Vision nodes)
- default DNS upstream: udp://10.35.99.172 (public UDP resolvers
  unreachable on this network; old-sub nodes are hostnames)
- Dockerfile: install PyYAML

Verified: 50-node reality+vision subscription works end-to-end
(sing-box check + live SOCKS tunnel); legacy vless:// subs unaffected.

Dockerfile

@@ -2,7 +2,9 @@
 FROM ghcr.io/sagernet/sing-box:latest AS sb-bin
 # ========== Stage 2: slim Python runtime + entrypoint.py ==========
 FROM python:3.13-slim
-RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && \
+    rm -rf /var/lib/apt/lists/* && \
+    pip install --no-cache-dir pyyaml
 COPY --from=sb-bin /usr/local/bin/sing-box /usr/local/bin/sing-box
 RUN chmod +x /usr/local/bin/sing-box
 WORKDIR /src