fix(frontend): Phase 9 — restore index dashboard, fix login/CSRF, port legacy styles

- Index dashboard regains the 8 cards that were lost in the SPA port
  (3X-UI panel info, Operation Hours, System Load, Usage, Overall Speed,
  Total Data, IP Addresses, Connection Stats), plus a Config button that
  shows the live xray config.json. Version display falls back through
  panelUpdateInfo → window.__X_UI_CUR_VER__ → '?' so dev mode isn't blank.
- Xray config no longer hangs on load: useXraySetting surfaces failures
  instead of leaving a perpetual spinner, and the Vite dev proxy stops
  hijacking POST requests to migrated routes (only GETs get bypassed).
- Inbound page no longer throws __asyncLoader/emitsOptions errors —
  inbound.js was missing imports (NumberFormatter, SizeFormatter,
  Wireguard) and InboundList kept emitting after unmount.
- Login round-trip works after logout: a public /csrf-token endpoint
  bootstraps the SPA before authentication, axios caches the token
  module-level, and the dev 401 handler navigates to /login.html
  instead of reloading the dashboard into a redirect loop.
- legacy.css mirrors the legacy panel's surface/text variables so dark
  and ultra-dark themes match main; every SPA entry imports it.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

frontend/vite.config.js

@@ -35,7 +35,12 @@ function makeBackendProxy(target, patterns) {
       // Returning a path from bypass tells Vite to serve that file from
       // its own dev server instead of forwarding the request — used here
       // to short-circuit /panel/<route> for pages we've already migrated.
+      //
+      // Only GETs get bypassed: the xray page reuses its page URL
+      // (`POST /panel/xray/`) for data, so a method-blind bypass would
+      // hand HTML back to fetch calls and break the page in dev.
       bypass(req) {
+        if (req.method !== 'GET') return undefined;
         const url = req.url.split('?')[0];
         if (Object.prototype.hasOwnProperty.call(MIGRATED_ROUTES, url)) {
           return MIGRATED_ROUTES[url];
@@ -85,7 +90,7 @@ export default defineConfig({
       // Patterns are anchored regex so /login.html and /index.html
       // (which Vite serves itself) are NOT forwarded — only the bare
       // backend paths and their sub-routes.
-      '^/(login|logout|getTwoFactorEnable)$',
+      '^/(login|logout|getTwoFactorEnable|csrf-token)$',
       '^/(panel|server)(/|$)',
     ]),
   },