feat(tls,reality): port xray TLS/REALITY fields, cert-hash helpers, fallback UX

TLS: add verifyPeerCertByName (vcn) to inbound settings + emit in both share-link generators (frontend + Go sub) and outbound parser; the allowInsecure replacement xray removed after 2026-06-01. Add server-side curvePreferences, masterKeyLog, echSockopt (passthrough + form) at tlsSettings top-level so they survive the panel-only settings strip.

REALITY: add limitFallbackUpload/Download (afterBytes/bytesPerSec/burstBytesPerSec) with per-field tooltips, plus masterKeyLog. Verified field names/semantics against pinned xray v1.260327.1 (bytesPerSec=0 disables).

Hosts: fix verify_peer_cert_by_name column bool->string (xray expects comma-separated names) with an idempotent, history-gate-free migration (SQLite typeof blank; Postgres ALTER once); emit vcn for hosts/external proxies.

Server: add getCertHash (local cert DER SHA-256) and getRemoteCertHash (xray tls ping) endpoints + api-docs; wire pinned-cert field buttons. Drop the meaningless random-hash button.

Xray UI: metrics endpoint (listen/tag) config in Basics; import/export for routing rules and outbounds.

Fallbacks card: compact empty state, header-aligned actions, responsive labeled grid rows.

i18n: add all new keys to every locale; drop unused generateRandomPin.

frontend/src/pages/xray/basics/BasicsTab.tsx

@@ -70,6 +70,28 @@ export default function BasicsTab({
     [mutate],
   );
 
+  const metricsCfg = (templateSettings as { metrics?: { tag?: string; listen?: string } } | null)?.metrics;
+
+  const setMetrics = useCallback(
+    (field: 'tag' | 'listen', value: string) => mutate((tt) => {
+      const node = tt as { metrics?: { tag?: string; listen?: string }; stats?: Record<string, unknown> };
+      const m: { tag?: string; listen?: string } = { ...(node.metrics ?? {}) };
+      if (value.trim() === '') {
+        delete m[field];
+      } else {
+        m[field] = value.trim();
+      }
+      if (!m.listen && !m.tag) {
+        delete node.metrics;
+      } else {
+        node.metrics = m;
+        // xray-core's metrics handler needs a stats object to populate.
+        if (!node.stats) node.stats = {};
+      }
+    }),
+    [mutate],
+  );
+
   function confirmResetDefault() {
     modal.confirm({
       title: t('pages.settings.resetDefaultConfig'),
@@ -272,6 +294,29 @@ export default function BasicsTab({
               }
             />
           ))}
+          <SettingListItem
+            title={t('pages.xray.metricsListen')}
+            description={t('pages.xray.metricsListenDesc')}
+            paddings="small"
+            control={
+              <Input
+                value={metricsCfg?.listen ?? ''}
+                onChange={(e) => setMetrics('listen', e.target.value)}
+                placeholder="127.0.0.1:11111"
+              />
+            }
+          />
+          <SettingListItem
+            title={t('pages.xray.metricsTag')}
+            paddings="small"
+            control={
+              <Input
+                value={metricsCfg?.tag ?? ''}
+                onChange={(e) => setMetrics('tag', e.target.value)}
+                placeholder="metrics_out"
+              />
+            }
+          />
         </>
       ),
     },