feat(tls,reality): port xray TLS/REALITY fields, cert-hash helpers, fallback UX

TLS: add verifyPeerCertByName (vcn) to inbound settings + emit in both share-link generators (frontend + Go sub) and outbound parser; the allowInsecure replacement xray removed after 2026-06-01. Add server-side curvePreferences, masterKeyLog, echSockopt (passthrough + form) at tlsSettings top-level so they survive the panel-only settings strip.

REALITY: add limitFallbackUpload/Download (afterBytes/bytesPerSec/burstBytesPerSec) with per-field tooltips, plus masterKeyLog. Verified field names/semantics against pinned xray v1.260327.1 (bytesPerSec=0 disables).

Hosts: fix verify_peer_cert_by_name column bool->string (xray expects comma-separated names) with an idempotent, history-gate-free migration (SQLite typeof blank; Postgres ALTER once); emit vcn for hosts/external proxies.

Server: add getCertHash (local cert DER SHA-256) and getRemoteCertHash (xray tls ping) endpoints + api-docs; wire pinned-cert field buttons. Drop the meaningless random-hash button.

Xray UI: metrics endpoint (listen/tag) config in Basics; import/export for routing rules and outbounds.

Fallbacks card: compact empty state, header-aligned actions, responsive labeled grid rows.

i18n: add all new keys to every locale; drop unused generateRandomPin.

frontend/src/schemas/api/host.ts

@@ -46,7 +46,12 @@ export const HostFormSchema = z.object({
   overrideSniFromAddress: z.boolean().default(false),
   keepSniBlank: z.boolean().default(false),
   pinnedPeerCertSha256: z.array(z.string()).default([]),
-  verifyPeerCertByName: z.boolean().default(false),
+  // Comma-separated cert names (xray `vcn`). Legacy rows stored a boolean here;
+  // coerce any stray bool to '' so old data loads cleanly.
+  verifyPeerCertByName: z.preprocess(
+    (v) => (typeof v === 'boolean' ? '' : v),
+    z.string().default(''),
+  ),
   allowInsecure: z.boolean().default(false),
   echConfigList: z.string().default(''),
 
@@ -98,7 +103,10 @@ export const HostRecordSchema = z.object({
   overrideSniFromAddress: z.boolean().optional(),
   keepSniBlank: z.boolean().optional(),
   pinnedPeerCertSha256: z.array(z.string()).nullish(),
-  verifyPeerCertByName: z.boolean().optional(),
+  verifyPeerCertByName: z.preprocess(
+    (v) => (typeof v === 'boolean' ? '' : v),
+    z.string().optional(),
+  ),
   allowInsecure: z.boolean().optional(),
   echConfigList: z.string().optional(),
   muxParams: z.unknown().optional(),