fix(web): sync the VLESS generate-key dropdown with the encryption field

The auth-kind dropdown in the VLESS "Generate Key" block was hardcoded to
x25519 on mount, while the "Already selected" text next to it was derived
independently from settings.encryption. Editing an inbound whose encryption
uses another kind (e.g. ML-KEM-768) showed a mismatched dropdown, and
clicking Generate without noticing would produce a keypair of the wrong
kind for the inbound.

Extract the encryption-string parsing into a shared pure helper
(lib/xray/vless-encryption), use it both for the selected-auth label and to
initialize/sync the dropdown, so the two can no longer diverge. When the
encryption is none or unparseable the dropdown keeps its x25519 default.

Closes #5744

frontend/src/lib/xray/vless-encryption.ts

@@ -0,0 +1,29 @@
+export type VlessAuthKind =
+  | 'x25519'
+  | 'x25519_xorpub'
+  | 'x25519_random'
+  | 'mlkem768'
+  | 'mlkem768_xorpub'
+  | 'mlkem768_random';
+
+export const VLESS_AUTH_LABEL_KEYS: Record<VlessAuthKind, string> = {
+  x25519: 'pages.inbounds.vlessAuthX25519',
+  x25519_xorpub: 'pages.inbounds.vlessAuthX25519Xorpub',
+  x25519_random: 'pages.inbounds.vlessAuthX25519Random',
+  mlkem768: 'pages.inbounds.vlessAuthMlkem768',
+  mlkem768_xorpub: 'pages.inbounds.vlessAuthMlkem768Xorpub',
+  mlkem768_random: 'pages.inbounds.vlessAuthMlkem768Random',
+};
+
+const MLKEM768_MIN_KEY_LENGTH = 300;
+
+export function vlessEncryptionAuthKind(encryption: string): VlessAuthKind | null {
+  if (!encryption || encryption === 'none') return null;
+  const parts = encryption.split('.').filter(Boolean);
+  const authKey = parts[parts.length - 1] || '';
+  if (!authKey) return null;
+  const mode = parts[1] || 'native';
+  const keyType = authKey.length > MLKEM768_MIN_KEY_LENGTH ? 'mlkem768' : 'x25519';
+  if (mode === 'xorpub' || mode === 'random') return `${keyType}_${mode}`;
+  return keyType;
+}