## Why

The Surge template uses `{{ ss_port }}`, `{{ ss_cipher }}`, and `{{ ss_password }}` directly, but these are defined in `group_vars/relay.yml` — only available to `relay` group hosts. The localhost play has no access to them, causing "'ss_port' is undefined" errors.

## What Changes

- Change the SS variable references in `templates/surge-client.conf.j2` to use `hostvars[groups['relay'][0]]` — the same pattern already used for `ansible_host` on the same line

## Capabilities

### New Capabilities
<!-- none -->

### Modified Capabilities
<!-- none -->

## Impact

- `templates/surge-client.conf.j2`: update SS variable references to use hostvars