PortRelay：把内网服务临时、可控地开放给同事

边缘网关 + Agent 的端口中继：Agent 主动连出到网关，把内网目标挂到网关端口上；
通过邀请链接按设备授权，可选审批，首次连接起计时，到期、闲置自动收回。

- portrelay-server：边缘网关（端口池、白名单与授权租约、邀请与授权网页）
- portrelay-agent：Agent（yamux 隧道、本地 API 与网页面板、流量统计）
- mac-native：SwiftUI 菜单栏 App

client/probe.go

@@ -0,0 +1,45 @@
+package client
+
+import (
+	"fmt"
+	"net"
+	"time"
+)
+
+// ProbeResult holds ping/reachability info
+type ProbeResult struct {
+	Target    string        `json:"target"`
+	Reachable bool          `json:"reachable"`
+	RTT       time.Duration `json:"rtt"`
+	Error     string        `json:"error,omitempty"`
+}
+
+// ProbeTarget checks if this machine can reach target
+func ProbeTarget(target string, timeout time.Duration) ProbeResult {
+	if timeout <= 0 {
+		timeout = 2 * time.Second
+	}
+
+	start := time.Now()
+	conn, err := net.DialTimeout("tcp", target, timeout)
+	if err != nil {
+		return ProbeResult{
+			Target:    target,
+			Reachable: false,
+			RTT:       time.Since(start),
+			Error:     err.Error(),
+		}
+	}
+	defer conn.Close()
+
+	return ProbeResult{
+		Target:    target,
+		Reachable: true,
+		RTT:       time.Since(start),
+	}
+}
+
+// FormatRTT formats duration in ms
+func (pr ProbeResult) FormatRTT() string {
+	return fmt.Sprintf("%.1f ms", float64(pr.RTT.Microseconds())/1000.0)
+}