feat: add compatible Trojan manager image

Dockerfile

@@ -0,0 +1,32 @@
+# syntax=docker/dockerfile:1
+ARG RUNTIME_BASE=jrohy/trojan@sha256:f559fac7e9960614032e520c59405cec0e8937eca009a8169cb1d188f2b5ccb9
+FROM node:20.11.1-bookworm AS frontend
+WORKDIR /src
+COPY trojan-web-master/package.json trojan-web-master/package-lock.json ./
+RUN npm ci
+COPY trojan-web-master/ ./
+RUN npm run build
+
+FROM golang:1.21.6-bookworm AS manager-build
+WORKDIR /src
+COPY trojan-master/go.mod trojan-master/go.sum ./
+RUN go mod download
+COPY trojan-master/ ./
+COPY --from=frontend /src/dist ./web/templates
+RUN CGO_ENABLED=0 GOOS=linux go build -trimpath -ldflags='-s -w' -o /out/trojan .
+
+# Production builds pass an immutable, verified runtime snapshot that contains
+# the legacy Trojan core. This avoids a runtime download and preserves protocol
+# compatibility during the first replacement release.
+FROM ${RUNTIME_BASE}
+COPY --from=manager-build /out/trojan /usr/local/bin/trojan
+COPY trojan-master/asset/trojan.service /etc/systemd/system/trojan.service
+COPY trojan-master/asset/trojan-web.service /etc/systemd/system/trojan-web.service
+COPY trojan-master/asset/trojan-acme-challenge.service /etc/systemd/system/trojan-acme-challenge.service
+COPY trojan-master/asset/trojan-acme-renew.service /etc/systemd/system/trojan-acme-renew.service
+COPY trojan-master/asset/trojan-acme-renew.timer /etc/systemd/system/trojan-acme-renew.timer
+COPY trojan-master/asset/renew-trojan-certificate /usr/local/sbin/renew-trojan-certificate
+COPY trojan-master/asset/compat-init /usr/local/sbin/compat-init
+RUN chmod 0755 /usr/local/sbin/renew-trojan-certificate /usr/local/sbin/compat-init
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=3 CMD curl -fsS "http://127.0.0.1:${WEB_PORT:-8081}/healthz" || exit 1
+CMD ["/usr/local/sbin/compat-init"]