test(sub): cover Hysteria2 Allow Insecure propagation to sub links

applyExternalProxyHysteriaParams and buildHysteriaProxy previously had no
direct test asserting insecure=1 / skip-cert-verify: true for a host/
external-proxy entry with allowInsecure set — the existing tests only
locked in the untouched pin/SNI behavior. Add positive and negative cases
for both the raw-link and Clash paths so the #5865 fix has a regression
test of its own.

internal/sub/clash_service_test.go

@@ -858,3 +858,47 @@ func TestBuildWireguardProxyForClashNoKey(t *testing.T) {
 		t.Fatalf("buildProxy = %v, want nil for a keyless wireguard client", proxy)
 	}
 }
+
+func TestBuildHysteriaProxy_HostAllowInsecureSetsSkipCertVerify(t *testing.T) {
+	svc := &SubClashService{SubService: &SubService{}}
+	inbound := &model.Inbound{
+		Listen:         "203.0.113.9",
+		Port:           443,
+		Protocol:       model.Hysteria,
+		Remark:         "hy",
+		Settings:       `{"version":2,"clients":[{"auth":"hyauth","email":"user"}]}`,
+		StreamSettings: `{"security":"tls","tlsSettings":{"serverName":"hy.sni"}}`,
+	}
+	client := model.Client{Email: "user", Auth: "hyauth"}
+	ep := map[string]any{"allowInsecure": true}
+
+	proxy := svc.buildHysteriaProxy(svc.SubService, inbound, client, ep)
+	if proxy == nil {
+		t.Fatal("buildHysteriaProxy returned nil")
+	}
+	if v, _ := proxy["skip-cert-verify"].(bool); !v {
+		t.Fatalf("skip-cert-verify = %v, want true when ep allowInsecure is set", proxy["skip-cert-verify"])
+	}
+}
+
+func TestBuildHysteriaProxy_NoHostAllowInsecureOmitsSkipCertVerify(t *testing.T) {
+	svc := &SubClashService{SubService: &SubService{}}
+	inbound := &model.Inbound{
+		Listen:         "203.0.113.9",
+		Port:           443,
+		Protocol:       model.Hysteria,
+		Remark:         "hy",
+		Settings:       `{"version":2,"clients":[{"auth":"hyauth","email":"user"}]}`,
+		StreamSettings: `{"security":"tls","tlsSettings":{"serverName":"hy.sni"}}`,
+	}
+	client := model.Client{Email: "user", Auth: "hyauth"}
+	ep := map[string]any{}
+
+	proxy := svc.buildHysteriaProxy(svc.SubService, inbound, client, ep)
+	if proxy == nil {
+		t.Fatal("buildHysteriaProxy returned nil")
+	}
+	if _, ok := proxy["skip-cert-verify"]; ok {
+		t.Fatalf("skip-cert-verify should be unset without allowInsecure, got %v", proxy["skip-cert-verify"])
+	}
+}

internal/sub/service_test.go

@@ -854,6 +854,31 @@ func TestApplyExternalProxyHysteriaParams_NoPinLeavesMainPin(t *testing.T) {
 	}
 }
 
+func TestApplyExternalProxyHysteriaParams_AllowInsecureSetsInsecureParam(t *testing.T) {
+	params := map[string]string{"security": "tls", "sni": "server.example.com"}
+	ep := map[string]any{
+		"dest":          "edge.example.com",
+		"allowInsecure": true,
+	}
+
+	applyExternalProxyHysteriaParams(ep, params)
+
+	if params["insecure"] != "1" {
+		t.Fatalf("insecure = %q, want 1 when ep allowInsecure is true", params["insecure"])
+	}
+}
+
+func TestApplyExternalProxyHysteriaParams_NoAllowInsecureOmitsParam(t *testing.T) {
+	params := map[string]string{"security": "tls"}
+	ep := map[string]any{"dest": "edge.example.com"}
+
+	applyExternalProxyHysteriaParams(ep, params)
+
+	if _, ok := params["insecure"]; ok {
+		t.Fatalf("insecure should not be set when ep has no allowInsecure, got %v", params)
+	}
+}
+
 func TestApplyExternalProxyTLSParams_DoesNotApplyForNone(t *testing.T) {
 	params := map[string]string{
 		"security": "none",