Update BoxJs and README

Bumps [minimist](https://github.com/substack/minimist) from 1.2.5 to 1.2.6.
- [Release notes](https://github.com/substack/minimist/releases)
- [Commits](https://github.com/substack/minimist/compare/1.2.5...1.2.6)

---
updated-dependencies:
- dependency-name: minimist
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>

Add force-http-engine for Rewrite TCP connection

Bumps [async](https://github.com/caolan/async) from 2.6.3 to 2.6.4.
- [Release notes](https://github.com/caolan/async/releases)
- [Changelog](https://github.com/caolan/async/blob/v2.6.4/CHANGELOG.md)
- [Commits](caolan/async@v2.6.3...v2.6.4)

---
updated-dependencies:
- dependency-name: async
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>

仅使用会话数据，应用设置修改保存不更新原会话；关联使用会话数据，应用设置修改保存会更新原会话

- switch cookie/rewrite from m.ctrip.com to m.suanya.cn
- use \d+ in URL pattern for soa2 version number
- update Surge/QuanX/Loon task and cookie configs

Bumps [qs](https://github.com/ljharb/qs) from 6.11.0 to 6.14.1.
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.11.0...v6.14.1)

---
updated-dependencies:
- dependency-name: qs
  dependency-version: 6.14.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

- Move bubei/ to achived/bubei/
- Comment out bubei in Loon.cookie.conf and Loon.task.conf

Co-authored-by: Cursor <[email protected]>

Bumps [qs](https://github.com/ljharb/qs) from 6.14.1 to 6.14.2.
- [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md)
- [Commits](ljharb/qs@v6.14.1...v6.14.2)

---
updated-dependencies:
- dependency-name: qs
  dependency-version: 6.14.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

- Use hasOwnProperty for save path so boolean false updates persist
- Sync root chavy.box.js with box/chavy.boxjs.js
- Record 0.19.26 in box.release.json and box.release.tf.json
- Trim BoxJs subscription: drop archived apps and invalid yuexianhuo entry

Made-with: Cursor

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

…bump 0.19.28

Co-Authored-By: Claude Opus 4.6 <[email protected]>

主页顶部新增可关闭提示条，引导用户使用 iOS 原生客户端 Relay
(TestFlight: https://testflight.apple.com/join/2yES8TuF)，
偏好通过 localStorage 持久化。

Co-Authored-By: Claude Opus 4.6 <[email protected]>

Bumps [lodash](https://github.com/lodash/lodash) from 4.17.23 to 4.18.1.
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](lodash/lodash@4.17.23...4.18.1)

---
updated-dependencies:
- dependency-name: lodash
  dependency-version: 4.18.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [follow-redirects](https://github.com/follow-redirects/follow-redirects) from 1.15.6 to 1.16.0.
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](follow-redirects/follow-redirects@v1.15.6...v1.16.0)

---
updated-dependencies:
- dependency-name: follow-redirects
  dependency-version: 1.16.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…al run

- Surge manual/cron runs were hitting the cookie-capture branch because
  $request can be defined without a real MiTM context; now require url
  to match /welfarecenter/index/signIndex and headers to be present
- Drop tc_push_switch; sign-in results always push
- Register tongcheng-trip app in box/chavy.boxjs.json

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>