feat(tls,reality): port xray TLS/REALITY fields, cert-hash helpers, fallback UX

TLS: add verifyPeerCertByName (vcn) to inbound settings + emit in both share-link generators (frontend + Go sub) and outbound parser; the allowInsecure replacement xray removed after 2026-06-01. Add server-side curvePreferences, masterKeyLog, echSockopt (passthrough + form) at tlsSettings top-level so they survive the panel-only settings strip.

REALITY: add limitFallbackUpload/Download (afterBytes/bytesPerSec/burstBytesPerSec) with per-field tooltips, plus masterKeyLog. Verified field names/semantics against pinned xray v1.260327.1 (bytesPerSec=0 disables).

Hosts: fix verify_peer_cert_by_name column bool->string (xray expects comma-separated names) with an idempotent, history-gate-free migration (SQLite typeof blank; Postgres ALTER once); emit vcn for hosts/external proxies.

Server: add getCertHash (local cert DER SHA-256) and getRemoteCertHash (xray tls ping) endpoints + api-docs; wire pinned-cert field buttons. Drop the meaningless random-hash button.

Xray UI: metrics endpoint (listen/tag) config in Basics; import/export for routing rules and outbounds.

Fallbacks card: compact empty state, header-aligned actions, responsive labeled grid rows.

i18n: add all new keys to every locale; drop unused generateRandomPin.

internal/web/translation/en-US.json

@@ -588,10 +588,21 @@
         "buildChain": "Build Chain",
         "echKey": "ECH key",
         "echConfig": "ECH config",
+        "echSockopt": "ECH Sockopt",
+        "echSockoptTip": "Socket options for the connection Xray uses to fetch the ECH config list (e.g. route the lookup through a dialerProxy outbound). Leave disabled to use defaults.",
+        "curvePreferences": "Curve Preferences",
+        "curvePreferencesTip": "Restrict the TLS key-exchange curves the server offers, in preference order (e.g. X25519MLKEM768, X25519). Leave empty to use Xray-core defaults.",
+        "masterKeyLog": "Master Key Log",
+        "masterKeyLogTip": "Path to write TLS master keys (SSLKEYLOGFILE format) for debugging with Wireshark. Leave empty in production — it lets anyone with the file decrypt traffic.",
+        "verifyPeerCertByName": "Verify Peer Cert By Name",
+        "verifyPeerCertByNameTip": "Tell clients to verify the server certificate against this name instead of the SNI. Comma-separated names. Panel-only — included in share links (vcn). The modern replacement for allowInsecure, which Xray removed after 2026-06-01.",
         "pinnedPeerCertSha256": "Pinned Peer Cert SHA-256",
         "pinnedPeerCertSha256Tip": "SHA-256 hash(es) of the peer certificate as a hex string (e.g. e8e2d3…), comma-separated. Panel-only — not written to the server's xray config, but included in share links so clients can pin the certificate.",
         "pinnedPeerCertSha256Placeholder": "hex hash(es), comma-separated",
-        "generateRandomPin": "Generate random hash",
+        "pinFromCert": "Fill from this inbound's certificate",
+        "pinFromRemote": "Fetch the hash by pinging the SNI (xray tls ping)",
+        "pinFromRemoteNoSni": "Set the SNI (serverName) first to ping the remote certificate.",
+        "pinFromRemoteFailed": "Could not fetch the remote certificate hash.",
         "getNewEchCert": "Get New ECH Cert",
         "show": "Show",
         "xver": "Xver",
@@ -609,6 +620,15 @@
         "mldsa65Seed": "mldsa65 Seed",
         "mldsa65Verify": "mldsa65 Verify",
         "getNewSeed": "Get New Seed",
+        "limitFallback": "Limit Fallback",
+        "limitFallbackUpload": "Limit Fallback Upload",
+        "limitFallbackDownload": "Limit Fallback Download",
+        "afterBytes": "After Bytes",
+        "afterBytesTip": "Let the fallback run at full speed for this many bytes, then start throttling. 0 = throttle from the first byte.",
+        "bytesPerSec": "Bytes Per Sec",
+        "bytesPerSecTip": "Speed cap (bytes/sec) applied to fallback traffic after the threshold, so probes can't use your server as free bandwidth to the target. 0 = no limit (disables this direction).",
+        "burstBytesPerSec": "Burst Bytes Per Sec",
+        "burstBytesPerSecTip": "Allowance for short bursts above the steady rate (token-bucket size). If lower than Bytes Per Sec it is raised to match.",
         "listenHelp": "You can also enter a Unix socket path (e.g. /run/xray/in.sock), or an abstract socket name prefixed with @ (e.g. @xray/in.sock), to listen on a socket instead of a TCP port — set Port to 0 in that case.",
         "shareAddrStrategy": "Share address strategy",
         "shareAddrStrategyHelp": "Controls which address is written into exported share links, QR codes, and subscription output.",
@@ -1469,6 +1489,11 @@
       "OutboundsDesc": "Set the outgoing traffic pathway.",
       "Routings": "Routing Rules",
       "RoutingsDesc": "The priority of each rule is important!",
+      "importRules": "Import Rules",
+      "exportRules": "Export Rules",
+      "importOutbounds": "Import Outbounds",
+      "exportOutbounds": "Export Outbounds",
+      "importInvalidJson": "Invalid JSON — expected an array or an object with a matching key.",
       "completeTemplate": "All",
       "logLevel": "Log Level",
       "logLevelDesc": "The log level for error logs, indicating the information that needs to be recorded.",
@@ -1489,6 +1514,9 @@
       "statsOutboundUplinkDesc": "Enables the statistics collection for upstream traffic of all outbound proxies.",
       "statsOutboundDownlink": "Outbound Download Statistics",
       "statsOutboundDownlinkDesc": "Enables the statistics collection for downstream traffic of all outbound proxies.",
+      "metricsListen": "Metrics Endpoint",
+      "metricsListenDesc": "Expose Xray's Prometheus-style metrics on this address:port (e.g. 127.0.0.1:11111). Leave empty to disable. Bind to localhost and reverse-proxy it — it is unauthenticated.",
+      "metricsTag": "Metrics Tag",
       "connectionLimits": "Connection Limits",
       "connectionLimitsDesc": "Connection-level policies for user level 0. Leave a field empty to use Xray's default.",
       "connIdle": "Idle Timeout",