feat(mtproto): add MTProto (FakeTLS) protocol via managed mtg sidecar (#5076)

* feat(mtproto): add MTProto (FakeTLS) protocol via managed mtg sidecar

Xray-core has no mtproto proxy, so mtproto inbounds run as standalone
mtg (9seconds/mtg) sidecar processes managed by the panel — one per
inbound — and are excluded from the generated Xray config entirely.

- model: MTProto protocol constant, validator, and FakeTLS secret
  helpers (GenerateFakeTLSSecret/HealMtprotoSecret)
- mtproto package: per-inbound mtg process manager with reconcile,
  graceful stop, and best-effort Prometheus traffic scraping
- runtime: delegate mtproto inbounds to the mtg manager instead of the
  Xray gRPC API; skip mtproto when building the Xray config
- web: boot reconcile + StopAll wiring, periodic reconcile/traffic job,
  port-conflict transport, secret healing on inbound add/update
- sub: tg:// proxy share-link generation
- frontend: protocol option, Zod schema, Protocol tab (FakeTLS domain +
  regenerable secret), info-modal link, and i18n
- provisioning: fetch mtg v2.2.8 in install.sh, DockerInit.sh, and the
  Linux + Windows release workflows

* fix

* fix

* fix: address Copilot review comments on mtproto PR

- web/web.go: create NewMtprotoJob once and reuse for cron + initial run
- mtproto/manager.go: StopAll cleans up per-inbound config files on shutdown
- mtproto/manager.go: CollectTraffic releases mutex before HTTP scrapes to
  avoid blocking Ensure/Reconcile/Remove during network I/O
- database/model/model.go: panic on crypto/rand failure in mtprotoRandomMiddle
  instead of silently producing a weak all-zero secret
- install.sh: fix chmod to handle renamed bin/mtg-linux-arm on armv5/v6/v7

mtproto/manager_test.go

@@ -0,0 +1,56 @@
+package mtproto
+
+import (
+	"testing"
+
+	"github.com/mhsanaei/3x-ui/v3/database/model"
+)
+
+func TestParseMetricLine(t *testing.T) {
+	name, labels, val, err := parseMetricLine(`mtg_traffic{direction="to_client"} 12345`)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if name != "mtg_traffic" {
+		t.Fatalf("name=%q", name)
+	}
+	if labels["direction"] != "to_client" {
+		t.Fatalf("labels=%v", labels)
+	}
+	if val != 12345 {
+		t.Fatalf("val=%v", val)
+	}
+
+	name2, _, val2, err2 := parseMetricLine(`mtg_concurrency 7`)
+	if err2 != nil {
+		t.Fatal(err2)
+	}
+	if name2 != "mtg_concurrency" || val2 != 7 {
+		t.Fatalf("got %q %v", name2, val2)
+	}
+}
+
+func TestInstanceFromInbound(t *testing.T) {
+	ib := &model.Inbound{
+		Id:       3,
+		Tag:      "inbound-3",
+		Listen:   "0.0.0.0",
+		Port:     8443,
+		Protocol: model.MTProto,
+		Settings: `{"fakeTlsDomain":"example.com","secret":""}`,
+	}
+	inst, ok := InstanceFromInbound(ib)
+	if !ok {
+		t.Fatal("expected a usable instance")
+	}
+	if inst.Secret == "" {
+		t.Fatal("secret should be healed to a non-empty value")
+	}
+	if inst.Port != 8443 || inst.Id != 3 {
+		t.Fatalf("bad instance %+v", inst)
+	}
+
+	if _, ok := InstanceFromInbound(&model.Inbound{Protocol: model.VLESS}); ok {
+		t.Fatal("non-mtproto inbound should not produce an instance")
+	}
+}