fix(outbounds): support proxyProtocol on freedom outbound

Xray's freedom outbound accepts a numeric proxyProtocol (0 disabled,
1 or 2 for the PROXY protocol version), but the panel had no field for
it and the typed form adapter dropped the key on save — so a value set
via the JSON editor disappeared the moment the outbound was saved.

Model proxyProtocol through the freedom wire schema, the form schema,
and both adapter directions (clamped to 0/1/2, omitted from the wire
when 0), and add a Select (none / v1 / v2) to the freedom section of
the outbound form. Add round-trip test coverage and the proxyProtocol
label across all locales.

Closes #4486

frontend/src/lib/xray/outbound-form-adapter.ts

@@ -265,6 +265,10 @@ function freedomFromWire(raw: Raw): FreedomOutboundFormSettings {
       return (allowed.includes(s) ? s : '') as FreedomOutboundFormSettings['domainStrategy'];
     })(),
     redirect: asString(raw.redirect),
+    proxyProtocol: ((): FreedomOutboundFormSettings['proxyProtocol'] => {
+      const n = asNumber(raw.proxyProtocol, 0);
+      return (n === 1 || n === 2) ? n : 0;
+    })(),
     fragment: wireHasFragment
       ? {
           packets: asString(fragment.packets, '1-3'),
@@ -489,6 +493,7 @@ function freedomToWire(s: FreedomOutboundFormSettings) {
   return {
     domainStrategy: s.domainStrategy || undefined,
     redirect: s.redirect || undefined,
+    proxyProtocol: s.proxyProtocol || undefined,
     fragment: fragmentEnabled ? Object.fromEntries(fragmentEntries) : undefined,
     noises: s.noises.length > 0 ? s.noises : undefined,
     finalRules: s.finalRules.length > 0

frontend/src/pages/xray/OutboundFormModal.tsx

@@ -664,6 +664,15 @@ export default function OutboundFormModal({
                         <Form.Item label={t('pages.xray.outboundForm.redirect')} name={['settings', 'redirect']}>
                           <Input />
                         </Form.Item>
+                        <Form.Item label={t('pages.xray.outboundForm.proxyProtocol')} name={['settings', 'proxyProtocol']}>
+                          <Select
+                            options={[
+                              { value: 0, label: `(${t('none')})` },
+                              { value: 1, label: 'v1' },
+                              { value: 2, label: 'v2' },
+                            ]}
+                          />
+                        </Form.Item>
 
                         <Form.Item label={t('pages.xray.outboundForm.fragment')} shouldUpdate noStyle>
                           {() => {

frontend/src/schemas/forms/outbound-form.ts

@@ -166,6 +166,7 @@ export type FreedomFinalRuleForm = z.infer<typeof FreedomFinalRuleFormSchema>;
 export const FreedomOutboundFormSettingsSchema = z.object({
   domainStrategy: z.union([OutboundDomainStrategySchema, z.literal('')]).default(''),
   redirect: z.string().default(''),
+  proxyProtocol: z.number().int().min(0).max(2).default(0),
   fragment: FreedomFragmentSchema.default({
     packets: '1-3',
     length: '',

frontend/src/schemas/protocols/outbound/freedom.ts

@@ -52,6 +52,7 @@ export type FreedomFinalRule = z.infer<typeof FreedomFinalRuleSchema>;
 export const FreedomOutboundSettingsSchema = z.object({
   domainStrategy: OutboundDomainStrategySchema.optional(),
   redirect: z.string().optional(),
+  proxyProtocol: z.number().optional(),
   fragment: FreedomFragmentSchema.optional(),
   noises: z.array(FreedomNoiseSchema).optional(),
   finalRules: z.array(FreedomFinalRuleSchema).optional(),

frontend/src/test/outbound-form-adapter.test.ts

@@ -235,16 +235,26 @@ describe('outbound-form-adapter: round-trip', () => {
       settings: {
         domainStrategy: 'UseIPv4',
         redirect: '1.1.1.1',
+        proxyProtocol: 2,
         fragment: { packets: 'tlshello', length: '100-200' },
       },
     }));
     expect(filled.settings).toMatchObject({
       domainStrategy: 'UseIPv4',
       redirect: '1.1.1.1',
+      proxyProtocol: 2,
       fragment: { packets: 'tlshello', length: '100-200' },
     });
   });
 
+  it('freedom omits proxyProtocol when disabled (0)', () => {
+    const round = formValuesToWirePayload(rawOutboundToFormValues({
+      protocol: 'freedom',
+      settings: { proxyProtocol: 0 },
+    }));
+    expect((round.settings as { proxyProtocol?: number }).proxyProtocol).toBeUndefined();
+  });
+
   it('mux is only emitted when enabled AND protocol/network/flow allow it', () => {
     // Disabled mux: omitted
     const disabled = formValuesToWirePayload(rawOutboundToFormValues({