feat(clients,groups): client groups + sub-links export + dedicated groups page

Persistent client groups
- New ClientGroup model + client_groups table that holds empty
  (placeholder) groups so a user can define a label before any client
  references it. ListGroups merges these with the distinct group_name
  values already stored on clients and reports {name, clientCount}.
- ClientRecord gains group_name column; the model.Client wire shape
  gains a matching `group` JSON field that survives the
  inbound.settings → SyncInbound round-trip.
- Rename/Delete on a group mutates client_groups (rename row / delete
  row) AND propagates to all matching clients in ClientRecord and in
  every owning inbound's settings JSON, all in one transaction.

Bulk operations
- AssignGroup(emails, group) updates clients.group_name + patches each
  affected inbound's settings JSON in one read-modify-write per inbound.
  Empty group clears the label. Auto-creates the client_groups row when
  the user assigns to a brand-new name.
- BulkResetTraffic(emails) loops the existing single-reset path so the
  caller can zero traffic across a whole selection or a whole group.
- EmailsByGroup(name) returns just the email list (used by the groups
  page to fan a single bulk action over every member).

Endpoints (all under /panel/api/clients)
- GET  /groups                         — summaries with counts
- GET  /groups/:name/emails            — emails in a group
- POST /groups/create                  — empty placeholder group
- POST /groups/rename                  — rename (table + clients + JSON)
- POST /groups/delete                  — drop label everywhere (clients survive)
- POST /bulkAssignGroup                — assign N selected clients
- POST /bulkResetTraffic               — reset traffic on a list

Clients page UX
- New Group column (Actions → Client → Group → Inbounds → …) with a
  click-to-filter chip.
- FilterDrawer gains a multi-select Group filter whose options come
  from the new ClientPageResponse.groups field (sourced from ListGroups
  so empty/placeholder groups are pickable too).
- Single-client and bulk-add forms gain a Group AutoComplete pre-loaded
  with all known group names.
- New toolbar buttons when selection > 0: "Group ({n})" opens
  BulkAssignGroupModal, "Sub links ({n})" opens SubLinksModal.

Sub-links export modal (new SubLinksModal.tsx)
- Table of selected clients with their subscription URL (and JSON URL
  when subJsonEnable is on), per-row copy, Copy all, and Download as
  sub-links-<timestamp>.txt. Warns when subscription is disabled or
  none of the selected clients have a subId.

Dedicated Groups page (new pages/groups/GroupsPage.tsx)
- /groups route + sidebar entry (TagsOutlined icon) + page title key.
- Card-based layout matching Clients/Inbounds/Nodes — summary card with
  Total/Grouped/Empty stats, main card with Add Group button + table.
- Per-row More dropdown (icon-first column on the left): Sub links,
  Adjust (days+traffic), Reset traffic, Rename, Delete clients in
  group, Delete group (keep clients). Empty groups disable the
  client-targeted actions.
- Reuses SubLinksModal and ClientBulkAdjustModal — emails for the
  group are fetched on demand from GET /groups/:name/emails.

Other polish
- /groups + groups-page selectors added to page-shell.css and
  page-cards.css so the new page inherits the same background, padding,
  card borders, hover shadow, and summary-card padding.
- .card-toolbar gains a small vertical padding so the larger toolbar
  buttons (now default size, matching Inbounds) don't crowd the top of
  the card-head on Clients and Groups pages.

web/translation/en-US.json

@@ -102,6 +102,7 @@
     "dashboard": "Overview",
     "inbounds": "Inbounds",
     "clients": "Clients",
+    "groups": "Groups",
     "nodes": "Nodes",
     "settings": "Panel Settings",
     "xray": "Xray Configs",
@@ -482,6 +483,9 @@
       "subId": "Subscription ID",
       "online": "Online",
       "email": "Email",
+      "group": "Group",
+      "groupDesc": "Logical label used to bucket related clients (e.g. team, customer, region). Filterable from the toolbar.",
+      "groupPlaceholder": "e.g. customer-a",
       "comment": "Comment",
       "traffic": "Traffic",
       "offline": "Offline",
@@ -509,6 +513,21 @@
       "deleteConfirmContent": "This removes the client from every attached inbound and drops its traffic record. This cannot be undone.",
       "deleteSelected": "Delete ({count})",
       "adjustSelected": "Adjust ({count})",
+      "subLinksSelected": "Sub links ({count})",
+      "assignGroupSelected": "Group ({count})",
+      "assignGroupTitle": "Assign group to {count} client(s)",
+      "assignGroupTooltip": "Pick an existing group or type a new name. Leave blank to clear the group on the selected clients.",
+      "assignGroupPlaceholder": "Group name (leave blank to clear)",
+      "assignGroupAssignedToast": "Assigned {count} client(s) to {group}",
+      "assignGroupClearedToast": "Cleared group from {count} client(s)",
+      "subLinksTitle": "Sub links ({count})",
+      "subLinkColumn": "Subscription URL",
+      "subJsonLinkColumn": "Subscription JSON URL",
+      "subLinksCopyAll": "Copy all",
+      "subLinksCopiedAll": "Copied {count} link(s)",
+      "subLinksEmpty": "None of the selected clients have a subscription ID.",
+      "subLinksDisabled": "Subscription service is disabled.",
+      "subLinksDisabledHint": "Enable subscription in Panel Settings → Subscription to generate links.",
       "bulkDeleteConfirmTitle": "Delete {count} clients?",
       "bulkDeleteConfirmContent": "Each selected client is removed from every attached inbound and its traffic record is dropped. This cannot be undone.",
       "bulkAdjustTitle": "Adjust {count} clients",
@@ -543,6 +562,35 @@
         "delDepleted": "{count} depleted clients deleted"
       }
     },
+    "groups": {
+      "title": "Groups",
+      "name": "Name",
+      "clientCount": "Clients in group",
+      "totalGroups": "Total groups",
+      "totalGroupedClients": "Clients with a group",
+      "emptyGroups": "Empty groups",
+      "addGroup": "Add Group",
+      "createSuccess": "Group \"{name}\" created.",
+      "rename": "Rename",
+      "renameTitle": "Rename {name}",
+      "renameCollision": "A group named \"{name}\" already exists.",
+      "renameSuccess": "Renamed group on {count} client(s).",
+      "deleteConfirmTitle": "Delete group {name}?",
+      "deleteConfirmContent": "This removes the group and clears its label from {count} client(s). The clients themselves are not deleted.",
+      "deleteSuccess": "Cleared group from {count} client(s).",
+      "resetTraffic": "Reset traffic",
+      "resetConfirmTitle": "Reset traffic for group {name}?",
+      "resetConfirmContent": "This zeros up/down for all {count} client(s) in this group.",
+      "resetSuccess": "Reset traffic for {count} client(s).",
+      "adjustSuccess": "Adjusted {count} client(s) in {name}.",
+      "emptyForAction": "This group has no clients yet.",
+      "deleteGroupOnly": "Delete group (keep clients)",
+      "deleteClients": "Delete clients in group",
+      "deleteClientsConfirmTitle": "Delete all clients in {name}?",
+      "deleteClientsConfirmContent": "This permanently removes {count} client(s) along with their traffic records. The group label is cleared too. This cannot be undone.",
+      "deleteClientsSuccess": "Deleted {count} client(s).",
+      "deleteClientsMixed": "{ok} deleted, {failed} skipped"
+    },
     "nodes": {
       "title": "Nodes",
       "addNode": "Add Node",