feat(access-logs): opt-in Xray access-log collection and analytics pi…

…peline

- cc-agent 1.4.0: tail/ship module with cursor, spool and in-place rotation
- panel: authenticated gzip NDJSON ingest, durable spool, Parquet (DuckDB) storage
- search/summary dashboard with Mongo rollup fallback, retention and storage caps
- per-node provisioning with fingerprint-based reconcile, client IP masking

fix(agent): persist Xray users to config.json for crash-safe restarts

cc-agent now mirrors the authoritative user list into Xray's config.json (atomic, debounced) so systemd/crash/OOM restarts reload the correct users instead of a stale snapshot. Adds idempotent gRPC AddUser/RemoveUser, startup reconciliation with a grace window and a single heal-restart only when the on-disk config was stale, and removes the gRPC RestoreToXray replay. Bumps agent to 1.3.0 and surfaces an update notice for older agents.

Release 1.3.1

Fixes:
- subscription: map DoT (tls://) DNS to DoH for Xray configs (fixes VLESS routing slowdowns)
- mcp: zod 4 z.record signature

Features:
- subscription: full Incy client support (routing profile, virtual nodes, UA stats)

UI:
- panel version badge in settings tab caption (moved from system stat pill)
- sidebar/login version footer
- bulk-delete button restyled to match primary "Create" (red pill)

v1.2.0: Xray multi-inbound support

Panel:
- HyNode.xray.extraInbounds: schema for additional VLESS inbounds
- UI for managing multiple inbounds per node (TCP/WS/gRPC/XHTTP  Reality/TLS/None)
- Subscription generators emit one entry per published inbound
- Server-side X25519 key auto-generation, port/tag conflict detection

cc-agent:
- New inbounds[] config field with per-tag flow mapping
- Backward compatible with legacy inbound_tag (auto-probes flow from xray config)
- Version bump 1.1.0 -> 1.2.0

feat(stats): accurate Xray node traffic via outbound stats

Merge branch 'dev'