## Why

The Surge client configuration currently uses the relay server's raw IP address (`ansible_host`) for the Shadowsocks proxy definition. Using a domain name instead of a raw IP provides better flexibility (e.g., IP changes, CDN, TLS/SNI requirements) and consistency with how the landing server is configured.

## What Changes

- Add a `relay_domain` variable in `group_vars/relay.yml` for the relay server's domain name
- Update the Surge template to use `relay_domain` instead of the raw `ansible_host` for the relay proxy entry
- Update the relay example file to document the new variable

## Capabilities

### New Capabilities
<!-- none -->

### Modified Capabilities
- `shadowsocks-relay`: The relay server now has a configurable domain name used in Surge client config generation, replacing the raw IP reference
- `surge-config-gen`: The generated config uses a domain name for the relay instead of an IP address

## Impact

- `group_vars/relay.yml` — adds `relay_domain` variable
- `group_vars/relay.yml.example` — adds `relay_domain` placeholder
- `templates/surge-client.conf.j2` — changes relay proxy to use `relay_domain` variable instead of `ansible_host`