feat: add 180 questions (90 sc + 90 fb) for networking subtopics

Cover 9 subtopics from the computer networking documentation:
- http-handshake: TCP/TLS/HTTP2/HTTP3 handshakes
- http-connection-cost: connection resource overhead & million concurrency
- connection-pooling: pool reuse, HTTP/1.1 vs HTTP/2
- http-keepalive: Keep-Alive principle, head-of-line blocking
- keepalive-scenarios: when to enable/disable Keep-Alive
- domain-sharding: HTTP/1.1 hack, HTTP/2 obsolescence
- cdn: edge nodes, caching, DDoS protection
- cors: same-origin policy, preflight requests
- go-build-strip: -s -w flags, binary size optimization

topics/networking/cors/single_choice.json

@@ -0,0 +1,209 @@
+{
+  "topic": "cors",
+  "type": "single_choice",
+  "schema_version": "1.0.0",
+  "generated": "2026-09-02T21:20:00+08:00",
+  "questions": [
+    {
+      "id": "sc-001",
+      "type": "single_choice",
+      "difficulty": 2,
+      "tags": [
+        "CORS",
+        "同源策略"
+      ],
+      "question": "浏览器同源策略判断跨域的标准是什么？",
+      "options": {
+        "A": "是否同一台服务器",
+        "B": "协议 + 域名 + 端口三元组是否完全一致",
+        "C": "是否同一网段",
+        "D": "是否使用相同浏览器"
+      },
+      "answer": "B",
+      "explanation": "源（Origin）= 协议 + 域名 + 端口。三者必须完全一致才算同源，任何一个不一样就是跨域，浏览器会拦截。",
+      "source": null,
+      "related": []
+    },
+    {
+      "id": "sc-002",
+      "type": "single_choice",
+      "difficulty": 3,
+      "tags": [
+        "CORS",
+        "预检请求"
+      ],
+      "question": "浏览器在什么情况下会发送 OPTIONS 预检请求？",
+      "options": {
+        "A": "GET 请求",
+        "B": "POST 请求",
+        "C": "PUT/DELETE/自定义 Header 等非简单请求",
+        "D": "所有请求"
+      },
+      "answer": "C",
+      "explanation": "简单请求（GET/POST/HEAD + 简单 Header）浏览器直接发，看响应头判断。预检请求（PUT/DELETE/自定义 Header 等）浏览器先发 OPTIONS 探路，确认安全后才发真正请求。",
+      "source": null,
+      "related": []
+    },
+    {
+      "id": "sc-003",
+      "type": "single_choice",
+      "difficulty": 3,
+      "tags": [
+        "CORS",
+        "Access-Control-Allow-Origin"
+      ],
+      "question": "Access-Control-Allow-Origin: * 同时带 Cookie 时会怎样？",
+      "options": {
+        "A": "正常工作",
+        "B": "浏览器会拒绝",
+        "C": "Cookie 自动删除",
+        "D": "请求自动重试"
+      },
+      "answer": "B",
+      "explanation": "当请求携带凭据（Cookie、HTTP Auth）时，Access-Control-Allow-Origin 不能是通配符 *，必须是具体的源。这是为了防止任意网站都能通过你浏览器里的 Cookie 访问受保护资源。",
+      "source": null,
+      "related": []
+    },
+    {
+      "id": "sc-004",
+      "type": "single_choice",
+      "difficulty": 2,
+      "tags": [
+        "CORS",
+        "同源"
+      ],
+      "question": "http://localhost:3000 和 http://localhost:8080 是否同源？",
+      "options": {
+        "A": "同源",
+        "B": "跨域",
+        "C": "取决于浏览器",
+        "D": "取决于协议"
+      },
+      "answer": "B",
+      "explanation": "端口不同（3000 ≠ 8080）就是跨域。前后端分离开发时极其常见，前端在 3000 端口，后端 API 在 8080 端口。",
+      "source": null,
+      "related": []
+    },
+    {
+      "id": "sc-005",
+      "type": "single_choice",
+      "difficulty": 3,
+      "tags": [
+        "CORS",
+        "WebSocket"
+      ],
+      "question": "WebSocket 不受同源策略限制的原因是什么？",
+      "options": {
+        "A": "WebSocket 使用 UDP",
+        "B": "WebSocket 连接一旦建立就是全双工通信，不受 CORS 限制",
+        "C": "WebSocket 自带加密",
+        "D": "WebSocket 不经过浏览器"
+      },
+      "answer": "B",
+      "explanation": "WebSocket 连接一旦建立就是全双工通信，不受 CORS 限制。但建立连接的握手阶段（HTTP Upgrade 请求）仍然受同源策略影响。",
+      "source": null,
+      "related": []
+    },
+    {
+      "id": "sc-006",
+      "type": "single_choice",
+      "difficulty": 4,
+      "tags": [
+        "CORS",
+        "Nginx"
+      ],
+      "question": "生产环境中解决跨域最常用的方式是什么？",
+      "options": {
+        "A": "前端开发代理",
+        "B": "Nginx 反向代理",
+        "C": "后端设置 CORS 响应头",
+        "D": "使用 WebSocket"
+      },
+      "answer": "B",
+      "explanation": "生产环境中 Nginx 反向代理是最常用的方式。前端请求 app.example.com/api/，Nginx 代理到后端 localhost:8080，对浏览器来说是同源。",
+      "source": null,
+      "related": []
+    },
+    {
+      "id": "sc-007",
+      "type": "single_choice",
+      "difficulty": 3,
+      "tags": [
+        "CORS",
+        "预检请求"
+      ],
+      "question": "网络面板里一个请求出现两次，第一次是什么？",
+      "options": {
+        "A": "重试请求",
+        "B": "OPTIONS 预检请求",
+        "C": "缓存验证",
+        "D": "DNS 解析"
+      },
+      "answer": "B",
+      "explanation": "网络面板里一个请求出现两次，第一次是 OPTIONS 预检请求，不是 bug。浏览器先发 OPTIONS 探路，确认允许后才发真正请求。",
+      "source": null,
+      "related": []
+    },
+    {
+      "id": "sc-008",
+      "type": "single_choice",
+      "difficulty": 2,
+      "tags": [
+        "CORS",
+        "同源"
+      ],
+      "question": "https://app.example.com 和 https://api.example.com 是否同源？",
+      "options": {
+        "A": "同源",
+        "B": "跨域",
+        "C": "取决于端口",
+        "D": "取决于协议"
+      },
+      "answer": "B",
+      "explanation": "子域名不同（app.example.com ≠ api.example.com）就是跨域。即使在同一台服务器上，子域名不同也属于跨域。",
+      "source": null,
+      "related": []
+    },
+    {
+      "id": "sc-009",
+      "type": "single_choice",
+      "difficulty": 4,
+      "tags": [
+        "CORS",
+        "同源策略",
+        "安全"
+      ],
+      "question": "同源策略防止的攻击场景是什么？",
+      "options": {
+        "A": "DDoS 攻击",
+        "B": "恶意网站冒充用户向银行发起请求",
+        "C": "SQL 注入",
+        "D": "XSS 攻击"
+      },
+      "answer": "B",
+      "explanation": "同源策略防止的典型场景：你登录了银行网站（bank.com），浏览器存了 cookie，然后访问恶意网站（evil.com），evil.com 试图请求 bank.com/api/transfer 冒充你转账。同源策略会拦截这个请求。",
+      "source": null,
+      "related": []
+    },
+    {
+      "id": "sc-010",
+      "type": "single_choice",
+      "difficulty": 3,
+      "tags": [
+        "CORS",
+        "Vite"
+      ],
+      "question": "Vite 开发服务器中 server.proxy 配置的作用是什么？",
+      "options": {
+        "A": "加速构建",
+        "B": "将 /api 请求代理到后端，浏览器看到的请求始终在同源",
+        "C": "压缩代码",
+        "D": "热更新"
+      },
+      "answer": "B",
+      "explanation": "Vite 的 server.proxy 将 /api 请求代理到后端（如 localhost:8080），浏览器看到的请求始终在 localhost:3000，同源，不触发跨域。changeOrigin: true 修改请求头中的 Host 为目标地址。",
+      "source": null,
+      "related": []
+    }
+  ]
+}