fix: clamp gecko packet sizes; clarify obfs password visibility

- buildHysteria2SidecarConfig: clamp gecko min/max to hysteria's accepted
  bounds (1 <= min <= max <= 2048) to avoid emitting an invalid config.
- Document why the obfs password field is shown for both Salamander and Gecko
  (Gecko requires a password too).

Author: hawkff

app/src/main/java/io/nekohasekai/sagernet/fmt/hysteria/HysteriaFmt.kt

@@ -430,12 +430,15 @@ fun HysteriaBean.buildHysteria2SidecarConfig(
             if (caText.isNotBlank()) put("ca", caText)
         })
         if (hysteria2ObfsType == HysteriaBean.OBFS_GECKO && obfuscation.isNotBlank()) {
+            // Clamp to hysteria's accepted bounds: 1 <= min <= max <= 2048.
+            val min = geckoMinPacketSize.coerceIn(1, 2048)
+            val max = geckoMaxPacketSize.coerceIn(min, 2048)
             put("obfs", JSONObject().apply {
                 put("type", "gecko")
                 put("gecko", JSONObject().apply {
                     put("password", obfuscation)
-                    put("minPacketSize", geckoMinPacketSize)
-                    put("maxPacketSize", geckoMaxPacketSize)
+                    put("minPacketSize", min)
+                    put("maxPacketSize", max)
                 })
             })
         } else if (hysteria2ObfsType == HysteriaBean.OBFS_SALAMANDER && obfuscation.isNotBlank()) {

app/src/main/java/io/nekohasekai/sagernet/ui/profile/HysteriaSettingsActivity.kt

@@ -96,6 +96,8 @@ class HysteriaSettingsActivity : ProfileSettingsActivity<HysteriaBean>() {
             val isHy2 = version == 2
             obfsType.isVisible = isHy2
             if (isHy2) {
+                // Both Salamander and Gecko require an obfs password (apernet/hysteria
+                // clientConfigObfsGecko.Password is mandatory), so show it for either.
                 obfsPassword.isVisible = type != HysteriaBean.OBFS_NONE
                 val isGecko = type == HysteriaBean.OBFS_GECKO
                 geckoMin.isVisible = isGecko