chore(tools): 入库汽水签名工具链（独立签名服务与逆向记录）

- tools/mssdk-sign/：C++ 实现的签名服务，附 mssdk 内部结构记录、MinGW 与
  MSVC 两套构建脚本、调用示例 client.mjs 与自检入口
- signer/server.mjs：Node 实现的等价签名服务，面向「主服务不在 Windows 上」
  的场景——bdms.node 是 Windows PE 原生模块，只能由 Windows 版 Node 加载，
  故把「加载官方模块」关进独立进程，主服务经 HTTP 取 X-Helios / X-Medusa

两者都不被 src/sdk 引用：运行期走 sdk/qs/mssdk.ts 直接加载官方 bdms.node，
它们是组件升级、签名失效时重新定位入口并验证的手段，放在仓库里才能跟着
代码一起维护。

专有二进制（mssdk-sign.exe、metasecml.dll）由 tools/mssdk-sign/.gitignore
排除，不随仓库分发。

tools/mssdk-sign/build.bat

@@ -0,0 +1,16 @@
+@echo off
+rem MSVC native build (Windows). Source has UTF-8 Chinese comments -> /utf-8 is required.
+setlocal
+set VCVARS=C:\Program Files (x86)\Microsoft Visual Studio\18\BuildTools\VC\Auxiliary\Build\vcvars64.bat
+if not exist "%VCVARS%" (
+  echo [x] vcvars64.bat not found, edit VCVARS in this script
+  exit /b 1
+)
+call "%VCVARS%" >nul
+cl /nologo /O2 /EHsc /std:c++17 /utf-8 /W3 mssdk-sign.cpp /link /out:mssdk-sign.exe ws2_32.lib version.lib
+if errorlevel 1 (
+  echo [x] build failed
+  exit /b 1
+)
+echo [ok] built mssdk-sign.exe
+echo     selftest: mssdk-sign.exe --selftest --dll .\metasecml.dll