feat(clients): selective bulk attach + new bulk detach

Inbounds page:
- AttachClientsModal now shows a per-client selection table (email,
  comment, enabled tag) with search and a live "selected of total"
  counter; all clients are pre-selected so the old "attach all"
  workflow stays a single OK click.
- New DetachClientsModal on the inbound row menu lets you pick which
  clients to remove from that inbound (records are kept so they can be
  re-attached later; for full removal use Delete).

Clients page:
- New "Attach (N)" bulk-action button + BulkAttachInboundsModal that
  attaches selected clients to one or more multi-user inbounds.
- New "Detach (N)" bulk-action button + BulkDetachInboundsModal that
  removes selected clients from chosen inbounds; (email, inbound) pairs
  where the client isn't attached are silently skipped.

Backend adds POST /panel/api/clients/bulkDetach, wrapping the existing
Detach service for each email and reporting per-email
detached/skipped/errors. ClientRecord rows are kept on detach to match
the single-client endpoint; bulkDel remains the path for full removal.

web/translation/en-US.json

@@ -306,6 +306,16 @@
       "attachClientsNoTargets": "No other compatible inbounds available to attach to.",
       "attachClientsResult": "Attached {attached}, skipped {skipped}.",
       "attachClientsResultMixed": "Attached {attached}, skipped {skipped}, errors {errors}.",
+      "attachClientsSelectLabel": "Clients to attach",
+      "attachClientsSearchPlaceholder": "Search email or comment",
+      "attachClientsStatusDisabled": "Disabled",
+      "attachClientsSelectedCount": "{selected} of {total} selected",
+      "detachClients": "Detach Clients",
+      "detachClientsTitle": "Detach clients of \"{remark}\"",
+      "detachClientsDesc": "Removes the selected client(s) from this inbound only. Client records themselves are kept (use Delete to remove fully). Source has {count} clients in total.",
+      "detachClientsResult": "Detached {detached}, skipped {skipped}.",
+      "detachClientsResultMixed": "Detached {detached}, skipped {skipped}, errors {errors}.",
+      "detachClientsSelectLabel": "Clients to detach",
       "exportLinksTitle": "Export inbound links",
       "exportSubsTitle": "Export subscription links",
       "exportAllLinksTitle": "Export all inbound links",
@@ -532,6 +542,19 @@
       "assignGroupPlaceholder": "Group name (leave blank to clear)",
       "assignGroupAssignedToast": "Assigned {count} client(s) to {group}",
       "assignGroupClearedToast": "Cleared group from {count} client(s)",
+      "attachSelected": "Attach ({count})",
+      "attachToInboundsTitle": "Attach {count} client(s) to inbound(s)",
+      "attachToInboundsDesc": "Attaches the selected {count} client(s) (same UUID/password and shared traffic) to the chosen inbound(s). They keep their existing attachments too.",
+      "attachToInboundsTargets": "Target inbounds",
+      "attachToInboundsNoTargets": "No multi-user inbounds available to attach to.",
+      "detachSelected": "Detach ({count})",
+      "detach": "Detach",
+      "detachFromInboundsTitle": "Detach {count} client(s) from inbound(s)",
+      "detachFromInboundsDesc": "Removes the selected {count} client(s) from the chosen inbound(s). Pairs where the client wasn't attached are silently skipped. Client records are kept (use Delete to remove fully).",
+      "detachFromInboundsTargets": "Inbounds to detach from",
+      "detachFromInboundsNoTargets": "No multi-user inbounds available.",
+      "detachFromInboundsResult": "Detached {detached}, skipped {skipped}.",
+      "detachFromInboundsResultMixed": "Detached {detached}, skipped {skipped}, errors {errors}.",
       "subLinksTitle": "Sub links ({count})",
       "subLinkColumn": "Subscription URL",
       "subJsonLinkColumn": "Subscription JSON URL",

web/translation/fa-IR.json

@@ -301,6 +301,16 @@
       "attachClientsNoTargets": "اینباند سازگار دیگری برای اتصال وجود ندارد.",
       "attachClientsResult": "{attached} متصل شد، {skipped} رد شد.",
       "attachClientsResultMixed": "{attached} متصل شد، {skipped} رد شد، {errors} خطا.",
+      "attachClientsSelectLabel": "کلاینت‌های قابل اتصال",
+      "attachClientsSearchPlaceholder": "جستجوی ایمیل یا توضیح",
+      "attachClientsStatusDisabled": "غیرفعال",
+      "attachClientsSelectedCount": "{selected} از {total} انتخاب‌شده",
+      "detachClients": "جداسازی کلاینت‌ها",
+      "detachClientsTitle": "جداسازی کلاینت‌های «{remark}»",
+      "detachClientsDesc": "کلاینت‌های انتخاب‌شده فقط از همین اینباند جدا می‌شوند. خود رکورد کلاینت‌ها حفظ می‌شود (برای حذف کامل از Delete استفاده کنید). این اینباند مجموعاً {count} کلاینت دارد.",
+      "detachClientsResult": "{detached} جدا شد، {skipped} رد شد.",
+      "detachClientsResultMixed": "{detached} جدا شد، {skipped} رد شد، {errors} خطا.",
+      "detachClientsSelectLabel": "کلاینت‌های قابل جداسازی",
       "exportLinksTitle": "خروجی لینک‌های اینباند",
       "exportSubsTitle": "خروجی لینک‌های ساب",
       "exportAllLinksTitle": "خروجی لینک‌های همه اینباندها",
@@ -503,6 +513,19 @@
       "deleteConfirmContent": "این کلاینت از تمام اینباندهای متصل حذف و سابقه ترافیک آن پاک می‌شود. این عمل غیرقابل بازگشت است.",
       "deleteSelected": "حذف ({count})",
       "adjustSelected": "تنظیم ({count})",
+      "attachSelected": "اتصال ({count})",
+      "attachToInboundsTitle": "اتصال {count} کلاینت به اینباند(ها)",
+      "attachToInboundsDesc": "{count} کلاینت انتخاب‌شده (با همان UUID/پسورد و ترافیک مشترک) به اینباند(های) انتخابی متصل می‌شوند. روی اینباندهای فعلی هم باقی می‌مانند.",
+      "attachToInboundsTargets": "اینباندهای مقصد",
+      "attachToInboundsNoTargets": "اینباند سازگار برای اتصال وجود ندارد.",
+      "detachSelected": "جداسازی ({count})",
+      "detach": "جداسازی",
+      "detachFromInboundsTitle": "جداسازی {count} کلاینت از اینباند(ها)",
+      "detachFromInboundsDesc": "{count} کلاینت انتخاب‌شده از اینباند(های) انتخابی جدا می‌شوند. زوج‌هایی که کلاینت در آن‌ها متصل نیست بی‌صدا رد می‌شوند. خود رکورد کلاینت‌ها حفظ می‌شود (برای حذف کامل از Delete استفاده کنید).",
+      "detachFromInboundsTargets": "اینباندهای مبدأ",
+      "detachFromInboundsNoTargets": "اینباند سازگار وجود ندارد.",
+      "detachFromInboundsResult": "{detached} جدا شد، {skipped} رد شد.",
+      "detachFromInboundsResultMixed": "{detached} جدا شد، {skipped} رد شد، {errors} خطا.",
       "bulkDeleteConfirmTitle": "حذف {count} کلاینت؟",
       "bulkDeleteConfirmContent": "هر کلاینت انتخاب‌شده از تمام اینباندهای متصل حذف و سابقه ترافیک آن پاک می‌شود. این عمل غیرقابل بازگشت است.",
       "bulkAdjustTitle": "تنظیم {count} کلاینت",