feat(mtproto): add domain-fronting and essential mtg options

Expose mtg's [domain-fronting] section (ip/port/proxy-protocol) plus
proxy-protocol-listener, prefer-ip, and debug on MTProto inbounds. Each
key is written to the generated mtg-<id>.toml only when set, so mtg's own
defaults apply otherwise. The instance fingerprint now covers these
fields, so editing an option restarts the sidecar.

Since MTProto is mtg-served (not Xray), sniffing does not apply: hide the
Sniffing tab and the Advanced sniffing sub-editor, drop it from the
Advanced "All" JSON view, and emit empty sniffing in the wire payload,
all gated by a new canEnableSniffing predicate.

web/translation/zh-TW.json

@@ -503,7 +503,13 @@
         "encryptionMethod": "加密方法",
         "fakeTlsDomain": "FakeTLS 網域 (SNI)",
         "mtprotoSecret": "金鑰",
-        "mtprotoHint": "MTProto 由獨立的 mtg 程序提供服務，而非 Xray。傳輸設定與用戶端在此不適用——請將下方連結分享至 Telegram。",
+        "mtgDomainFrontingIp": "網域前置 IP",
+        "mtgDomainFrontingPort": "網域前置連接埠",
+        "mtgDomainFrontingProxyProtocol": "網域前置 PROXY 協定",
+        "mtgDomainFrontingHint": "mtg 轉發非 Telegram 流量的目標——例如你的 NGINX 偽裝站台。IP 留空則透過 DNS 解析 FakeTLS 網域；預設連接埠為 443。",
+        "mtgProxyProtocolListener": "接受 PROXY 協定（監聽器）",
+        "mtgPreferIp": "IP 偏好",
+        "mtgDebug": "除錯日誌",
         "visionTestseed": "Vision testseed",
         "version": "版本",
         "udpIdleTimeout": "UDP 閒置逾時 (s)",