fix: expose streamSettings for Tunnel inbounds to support TProxy (#5171)

* fix: expose streamSettings for Tunnel inbounds to support TProxy

* fix(ui): hide security tab for tunnel inbounds when stream is enabled

tunnel (dokodemo-door) does not support TLS or Reality, so showing the
security tab only results in a fully-disabled radio group. Exclude tunnel
alongside wireguard from the security tab.

* fix(tunnel): restrict stream tab to sockopt-only and fix transportless schema

Tunnel (dokodemo-door) only needs sockopt.tproxy for TProxy mode — no
user-selectable transport. Add hasSelectableTransport flag to hide the
network picker, per-network sub-forms, ExternalProxy, and FinalMask for
both tunnel and wireguard, matching the pattern already used for Hysteria.

Fix a pre-existing Zod schema bug where NetworkSettingsSchema was a bare
discriminatedUnion requiring `network` to be present. Wireguard and
tunnel submit streamSettings without a `network` key, causing
"Invalid discriminator value. Expected 'tcp' | ..." on every save. Fix
by adding a transportless union branch (z.never().optional()) alongside
the transport DU; also add ?? 'tcp' fallback in inbound-link.ts where
stream.network is now string | undefined. Three regression tests added.

---------

Co-authored-by: rqzbeh <rqzbeh@users.noreply.github.com>
Co-authored-by: MHSanaei <ho3ein.sanaei@gmail.com>

frontend/src/schemas/protocols/stream/index.ts

@@ -36,7 +36,7 @@ export type Network = z.infer<typeof NetworkSchema>;
 // `hysteria` is only valid when the parent protocol is hysteria — the
 // network selector hides it for other protocols. xray-core enforces
 // the constraint server-side too.
-export const NetworkSettingsSchema = z.discriminatedUnion('network', [
+const TransportNetworkSettingsSchema = z.discriminatedUnion('network', [
   z.object({ network: z.literal('tcp'),         tcpSettings:         TcpStreamSettingsSchema }),
   z.object({ network: z.literal('kcp'),         kcpSettings:         KcpStreamSettingsSchema }),
   z.object({ network: z.literal('ws'),          wsSettings:          WsStreamSettingsSchema }),
@@ -45,6 +45,17 @@ export const NetworkSettingsSchema = z.discriminatedUnion('network', [
   z.object({ network: z.literal('xhttp'),       xhttpSettings:       XHttpStreamSettingsSchema }),
   z.object({ network: z.literal('hysteria'),    hysteriaSettings:    HysteriaStreamSettingsSchema }),
 ]);
+
+// Wireguard (always a UDP listener) and Tunnel (dokodemo-door) expose no
+// user-selectable transport: their streamSettings carries no `network` key —
+// only security/sockopt, and Tunnel relies on `sockopt.tproxy` for its TProxy
+// mode. The transportless branch accepts that shape (network absent), while a
+// present-but-invalid network still fails both branches so a typo can't slip
+// through. `network: never().optional()` reads as "this key must be absent".
+export const NetworkSettingsSchema = z.union([
+  TransportNetworkSettingsSchema,
+  z.object({ network: z.never().optional() }),
+]);
 export type NetworkSettings = z.infer<typeof NetworkSettingsSchema>;
 
 // Orthogonal extras that ride alongside the network and security branches.