feat(xray): update xray-core to v26.9.8 and adapt panel

Bump xtls/xray-core to 37ceb8b4b6 (v26.9.8) and the three binary pins
(DockerInit.sh, release.yml Linux + Windows) in lockstep. No deleted
symbols; the impact is entirely on the JSON config surface.

Outbound "proxySettings" is now refused by the config loader (moved to
streamSettings.sockopt.dialerProxy) and a freedom outbound rejects
sockopt.addressPortStrategy. Either key in a stored template would keep
the core from starting after the upgrade, so a new OutboundRemovedKeysFix
seeder rewrites xrayTemplateConfig once: proxySettings.tag becomes
sockopt.dialerProxy (an existing dialerProxy wins) and addressPortStrategy
is dropped from freedom outbounds. Template saves and outbound
subscriptions already run through the vendored loader, so the new
refusals surface there with the core's own message.

REALITY no longer applies a built-in minClientVer (26.3.27) when the
field is empty. The form placeholder and the min/max hints in all 13
locales now say that empty means no minimum.

New upstream keys the Zod schemas would otherwise strip, with form
support where a sibling field already had it:
- blackhole response type "custom" with base64 customResponseData
- realm finalmask ipMode (dual/v4/v6) and portMapping (UPnP / NAT-PMP)
- quicParams brutalDisableLossCompensation, disableChromeParrot,
  disableGSO, disableStatelessReset
- hysteria masquerade proxy xForwarded
- wireguard outbound remoteDNS
- routing rule localOS

freedom.domainStrategy is only deprecated upstream (auto-migrated to
sockopt.domainStrategy with a warning) and is left untouched.

internal/web/translation/zh-TW.json

@@ -501,6 +501,7 @@
         "type": "類型",
         "upstreamUrl": "Upstream URL",
         "rewriteHost": "改寫 Host",
+        "xForwarded": "X-Forwarded 標頭",
         "skipTlsVerify": "略過 TLS 驗證",
         "directory": "目錄",
         "statusCode": "狀態碼",
@@ -602,8 +603,8 @@
         "maxTimeDiff": "最大時間差 (ms)",
         "minClientVer": "最小客戶端版本",
         "maxClientVer": "最大客戶端版本",
-        "minClientVerHint": "留空不等於不限制：Xray-core 會改用所執行核心版本的內建最低值（目前版本為 26.3.27），拒絕自報版本較低的客戶端——包括 Mihomo、sing-box 等第三方核心。填 1.0.0 可放行它們，代價是允許過時的 TLS 指紋。",
-        "maxClientVerHint": "留空表示無上限。若填寫，不得低於實際生效的下限——最小客戶端版本，該欄位留空時則為 Xray-core 的內建最低值——否則所有客戶端都會被拒絕。",
+        "minClientVerHint": "留空表示不設下限：Xray-core 接受任何客戶端版本，包括 Mihomo、sing-box 等第三方核心。填寫版本可拒絕自報版本較低的客戶端。",
+        "maxClientVerHint": "留空表示無上限。若填寫，不得低於最小客戶端版本，否則所有客戶端都會被拒絕。",
         "clientVerInvalid": "客戶端版本須為最多三段以點分隔的數字，每段 0-255（例如 26.3.27）",
         "maxClientVerBelowMin": "最大客戶端版本不得低於最小客戶端版本",
         "shortIds": "Short IDs",
@@ -1613,6 +1614,7 @@
         "inboundTag": "入站標籤",
         "inboundTagPlaceholder": "用於路由規則的入站標籤",
         "responseType": "回應類型",
+        "customResponseData": "自訂回應（base64）",
         "rewriteNetwork": "改寫網路",
         "unchanged": "(未變更)",
         "unchangedAddress": "(未變更) 如 1.1.1.1",
@@ -1625,6 +1627,7 @@
         "blockDelay": "阻斷延遲 (ms)",
         "reverseSniffing": "反向 sniffing",
         "reserved": "保留",
+        "remoteDNS": "遠端 DNS",
         "minUploadInterval": "最小上傳間隔 (ms)",
         "maxUploadSizeBytes": "最大上傳大小 (位元組)",
         "uplinkChunkSize": "Uplink chunk 大小",