feat: v2.1.0 核心重构与功能增强

## 架构重构
- 全局变量消除，迁移至 Config/State 对象
- SMB 插件融合（smb/smb2/smbghost/smbinfo）
- 服务探测重构，实现 Nmap 风格 fallback 机制
- 输出系统重构，TXT 实时刷盘 + 双写机制
- i18n 框架升级至 go-i18n

## 性能优化
- 正则表达式预编译
- 内存优化 map[string]struct{}
- 并发指纹匹配
- SOCKS5 连接复用
- 滑动窗口调度 + 自适应线程池

## 新功能
- Web 管理界面
- 多格式 POC 适配（xray/afrog）
- 增强指纹库（3139条）
- Favicon hash 指纹识别
- 插件选择性编译（Build Tags）
- fscan-lab 靶场环境
- 默认端口扩展（62→133）

## 构建系统
- 添加 no_local tag 支持排除本地插件
- 多版本构建：fscan/fscan-nolocal/fscan-web
- CI 添加 snapshot 模式支持仅测试构建

## Bug 修复
- 修复 120+ 个问题，包括 RDP panic、批量扫描漏报、
  JSON 输出格式、Redis 检测、Context 超时等

## 测试增强
- 单元测试覆盖率 74-100%
- 并发安全测试
- 集成测试（Web/端口/服务/SSH/ICMP）

plugins/services/vnc.go

@@ -0,0 +1,199 @@
+//go:build plugin_vnc || !plugin_selective
+
+package services
+
+import (
+	"context"
+	"strings"
+	"time"
+
+	vnc "github.com/mitchellh/go-vnc"
+	"github.com/shadow1ng/fscan/common"
+	"github.com/shadow1ng/fscan/common/i18n"
+	"github.com/shadow1ng/fscan/plugins"
+)
+
+// VNCPlugin VNC扫描插件
+type VNCPlugin struct {
+	plugins.BasePlugin
+}
+
+func NewVNCPlugin() *VNCPlugin {
+	return &VNCPlugin{
+		BasePlugin: plugins.NewBasePlugin("vnc"),
+	}
+}
+
+func (p *VNCPlugin) Scan(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
+	target := info.Target()
+
+	// 检查未授权访问
+	if result := p.testUnauthAccess(ctx, info, config, state); result != nil && result.Success {
+		common.LogSuccess(i18n.Tr("vnc_unauth", target))
+		return result
+	}
+
+	// 生成密码列表
+	var credentials []Credential
+	if config.Credentials.Passwords != nil {
+		for _, pass := range config.Credentials.Passwords {
+			credentials = append(credentials, Credential{Username: "", Password: pass})
+		}
+	} else {
+		defaultPasswords := []string{"123456", "password", "admin", "root", "vnc"}
+		for _, pass := range defaultPasswords {
+			credentials = append(credentials, Credential{Username: "", Password: pass})
+		}
+	}
+
+	// 使用公共框架进行并发凭据测试
+	authFn := p.createAuthFunc(info, config, state)
+	testConfig := DefaultConcurrentTestConfig(config)
+
+	result := TestCredentialsConcurrently(ctx, credentials, authFn, "vnc", testConfig)
+
+	if result.Success {
+		common.LogSuccess(i18n.Tr("vnc_credential", target, result.Password))
+	}
+
+	return result
+}
+
+// createAuthFunc 创建VNC认证函数
+func (p *VNCPlugin) createAuthFunc(info *common.HostInfo, config *common.Config, state *common.State) AuthFunc {
+	return func(ctx context.Context, cred Credential) *AuthResult {
+		return p.doVNCAuth(ctx, info, cred, config, state)
+	}
+}
+
+// doVNCAuth 执行VNC认证
+func (p *VNCPlugin) doVNCAuth(ctx context.Context, info *common.HostInfo, cred Credential, config *common.Config, state *common.State) *AuthResult {
+	target := info.Target()
+
+	resultChan := make(chan *AuthResult, 1)
+
+	go func() {
+		conn, err := common.WrapperTcpWithTimeout("tcp", target, config.Timeout)
+		if err != nil {
+			state.IncrementTCPFailedPacketCount()
+			resultChan <- &AuthResult{
+				Success:   false,
+				ErrorType: classifyVNCErrorType(err),
+				Error:     err,
+			}
+			return
+		}
+
+		_ = conn.SetDeadline(time.Now().Add(config.Timeout))
+
+		vncConfig := &vnc.ClientConfig{
+			Auth: []vnc.ClientAuth{
+				&vnc.PasswordAuth{Password: cred.Password},
+			},
+		}
+
+		client, err := vnc.Client(conn, vncConfig)
+		if err != nil {
+			_ = conn.Close()
+			state.IncrementTCPFailedPacketCount()
+			resultChan <- &AuthResult{
+				Success:   false,
+				ErrorType: classifyVNCErrorType(err),
+				Error:     err,
+			}
+			return
+		}
+
+		state.IncrementTCPSuccessPacketCount()
+
+		resultChan <- &AuthResult{
+			Success:   true,
+			Conn:      &vncClientWrapper{client, conn},
+			ErrorType: ErrorTypeUnknown,
+			Error:     nil,
+		}
+	}()
+
+	select {
+	case result := <-resultChan:
+		return result
+	case <-ctx.Done():
+		// context 被取消，启动清理协程等待并关闭可能创建的连接
+		go func() {
+			result := <-resultChan
+			if result != nil && result.Conn != nil {
+				_ = result.Conn.Close()
+			}
+		}()
+		return &AuthResult{
+			Success:   false,
+			ErrorType: ErrorTypeNetwork,
+			Error:     ctx.Err(),
+		}
+	}
+}
+
+// vncClientWrapper 包装VNC连接以实现io.Closer
+type vncClientWrapper struct {
+	*vnc.ClientConn
+	conn interface{ Close() error }
+}
+
+func (w *vncClientWrapper) Close() error {
+	_ = w.ClientConn.Close()
+	return w.conn.Close()
+}
+
+// classifyVNCErrorType VNC错误分类
+func classifyVNCErrorType(err error) ErrorType {
+	if err == nil {
+		return ErrorTypeUnknown
+	}
+
+	errStr := strings.ToLower(err.Error())
+
+	vncAuthErrors := []string{
+		"authentication failed",
+		"auth failed",
+		"password",
+		"unauthorized",
+		"access denied",
+	}
+
+	for _, keyword := range vncAuthErrors {
+		if strings.Contains(errStr, keyword) {
+			return ErrorTypeAuth
+		}
+	}
+
+	if strings.Contains(errStr, "too many authentication failures") {
+		return ErrorTypeNetwork
+	}
+
+	return ClassifyError(err, nil, CommonNetworkErrors)
+}
+
+func (p *VNCPlugin) testUnauthAccess(ctx context.Context, info *common.HostInfo, config *common.Config, state *common.State) *ScanResult {
+	cred := Credential{Username: "", Password: ""}
+	result := p.doVNCAuth(ctx, info, cred, config, state)
+
+	if result.Success {
+		if result.Conn != nil {
+			_ = result.Conn.Close()
+		}
+		return &ScanResult{
+			Type:    plugins.ResultTypeVuln,
+			Success: true,
+			Service: "vnc",
+			Banner:  "未授权访问",
+		}
+	}
+
+	return nil
+}
+
+func init() {
+	RegisterPluginWithPorts("vnc", func() Plugin {
+		return NewVNCPlugin()
+	}, []int{5900, 5901, 5902, 5903, 5904, 5905})
+}