feat(tls,reality): port xray TLS/REALITY fields, cert-hash helpers, fallback UX

TLS: add verifyPeerCertByName (vcn) to inbound settings + emit in both share-link generators (frontend + Go sub) and outbound parser; the allowInsecure replacement xray removed after 2026-06-01. Add server-side curvePreferences, masterKeyLog, echSockopt (passthrough + form) at tlsSettings top-level so they survive the panel-only settings strip.

REALITY: add limitFallbackUpload/Download (afterBytes/bytesPerSec/burstBytesPerSec) with per-field tooltips, plus masterKeyLog. Verified field names/semantics against pinned xray v1.260327.1 (bytesPerSec=0 disables).

Hosts: fix verify_peer_cert_by_name column bool->string (xray expects comma-separated names) with an idempotent, history-gate-free migration (SQLite typeof blank; Postgres ALTER once); emit vcn for hosts/external proxies.

Server: add getCertHash (local cert DER SHA-256) and getRemoteCertHash (xray tls ping) endpoints + api-docs; wire pinned-cert field buttons. Drop the meaningless random-hash button.

Xray UI: metrics endpoint (listen/tag) config in Basics; import/export for routing rules and outbounds.

Fallbacks card: compact empty state, header-aligned actions, responsive labeled grid rows.

i18n: add all new keys to every locale; drop unused generateRandomPin.

internal/web/translation/zh-TW.json

@@ -591,7 +591,6 @@
         "pinnedPeerCertSha256": "釘選對端憑證 SHA-256",
         "pinnedPeerCertSha256Tip": "對端憑證的 SHA-256 雜湊（十六進位字串，如 e8e2d3…），以逗號分隔。僅面板使用 — 不寫入伺服器的 xray 設定，但會包含在分享連結中，以便用戶端釘選憑證。",
         "pinnedPeerCertSha256Placeholder": "十六進位雜湊，以逗號分隔",
-        "generateRandomPin": "產生隨機雜湊",
         "getNewEchCert": "取得新 ECH 憑證",
         "show": "顯示",
         "xver": "Xver",
@@ -609,6 +608,27 @@
         "mldsa65Seed": "mldsa65 Seed",
         "mldsa65Verify": "mldsa65 Verify",
         "getNewSeed": "取得新 Seed",
+        "echSockopt": "ECH Sockopt",
+        "echSockoptTip": "Xray 用來取得 ECH 設定清單的連線之通訊端選項（例如讓查詢透過 dialerProxy 出站）。停用則使用預設值。",
+        "curvePreferences": "曲線偏好",
+        "curvePreferencesTip": "依偏好順序限制伺服器提供的 TLS 金鑰交換曲線（例如 X25519MLKEM768、X25519）。留空則使用 Xray-core 預設值。",
+        "masterKeyLog": "主金鑰日誌",
+        "masterKeyLogTip": "寫入 TLS 主金鑰的路徑（SSLKEYLOGFILE 格式），用於以 Wireshark 除錯。正式環境請留空——擁有該檔案的任何人都能解密流量。",
+        "verifyPeerCertByName": "依名稱驗證對端憑證",
+        "verifyPeerCertByNameTip": "要求客戶端以此名稱（而非 SNI）驗證伺服器憑證。以逗號分隔多個名稱。僅面板使用——會包含在分享連結中（vcn）。這是 allowInsecure 的新式替代方案，Xray 已於 2026-06-01 之後移除 allowInsecure。",
+        "pinFromCert": "從此入站的憑證填入",
+        "pinFromRemote": "透過 ping SNI 取得雜湊值（xray tls ping）",
+        "pinFromRemoteNoSni": "請先設定 SNI（serverName）才能 ping 遠端憑證。",
+        "pinFromRemoteFailed": "無法取得遠端憑證雜湊值。",
+        "limitFallback": "限制 Fallback",
+        "limitFallbackUpload": "限制 Fallback 上傳",
+        "limitFallbackDownload": "限制 Fallback 下載",
+        "afterBytes": "起算位元組",
+        "afterBytesTip": "讓 fallback 以全速傳輸此數量的位元組後，再開始限速。0 = 從第一個位元組起即限速。",
+        "bytesPerSec": "每秒位元組",
+        "bytesPerSecTip": "在達到門檻後套用於 fallback 流量的速度上限（位元組/秒），使探測無法將你的伺服器當成通往目標的免費頻寬。0 = 不限制（停用此方向）。",
+        "burstBytesPerSec": "每秒突發位元組",
+        "burstBytesPerSecTip": "允許短暫超出穩定速率的額度（token-bucket 大小）。若低於「每秒位元組」，則會提升至與其相同。",
         "listenHelp": "也可以填寫 Unix socket 路徑（例如 /run/xray/in.sock），或以 @ 為前綴的抽象通訊端名稱（例如 @xray/in.sock），以使用通訊端而非 TCP 連接埠監聽——此時請將連接埠設為 0。",
         "shareAddrStrategy": "分享地址策略",
         "shareAddrStrategyHelp": "控制匯出分享連結、QR Code 和訂閱輸出時寫入哪個地址。",
@@ -1303,6 +1323,14 @@
       "stopSuccess": "Xray 已成功停止",
       "restartError": "重新啟動Xray時發生錯誤。",
       "stopError": "停止Xray時發生錯誤。",
+      "importRules": "匯入規則",
+      "exportRules": "匯出規則",
+      "importOutbounds": "匯入出站",
+      "exportOutbounds": "匯出出站",
+      "importInvalidJson": "無效的 JSON——預期為陣列或含有相符鍵的物件。",
+      "metricsListen": "Metrics 端點",
+      "metricsListenDesc": "在此 address:port 上公開 Xray 的 Prometheus 風格 metrics（例如 127.0.0.1:11111）。留空則停用。請綁定 localhost 並以反向代理轉發——此端點未經驗證。",
+      "metricsTag": "Metrics 標籤",
       "basicTemplate": "基礎配置",
       "advancedTemplate": "高階配置",
       "generalConfigs": "常規配置",