feat(tls): surface pinnedPeerCertSha256 in panel, share links, and subs

Adds a panel-only `pinnedPeerCertSha256` field on TLS settings with a tags input and a random-hash generator. The hashes ride share links as `pcs` (v2rayN-compatible), Clash sub as `pin-sha256`, and JSON sub as `pinnedPeerCertSha256`, while remaining stripped from the run-config sent to xray-core.

web/translation/en-US.json

@@ -536,6 +536,10 @@
         "buildChain": "Build Chain",
         "echKey": "ECH key",
         "echConfig": "ECH config",
+        "pinnedPeerCertSha256": "Pinned Peer Cert SHA-256",
+        "pinnedPeerCertSha256Tip": "Base64-encoded SHA-256 hashes of the peer certificate. Panel-only — not written to the server's xray config, but included in share links so clients can pin the certificate.",
+        "pinnedPeerCertSha256Placeholder": "base64 hash(es), comma-separated",
+        "generateRandomPin": "Generate random hash",
         "getNewEchCert": "Get New ECH Cert",
         "show": "Show",
         "xver": "Xver",