feat(wireguard): client config UX, collapsible config card, configurable DNS

Land the WireGuard client-config UX work on main (the upstream PR #5642
branch could not be pushed to).

- Reusable collapsible ConfigBlock (copy/download/QR, actions aligned right)
  for the client .conf, used by client info and the public sub page.
- Correct .conf: canonical PresharedKey casing and DNS sourced from the inbound
  (configurable per-inbound, default 1.1.1.1, 1.0.0.1).
- Configurable per-inbound DNS for WireGuard (schema + form + backend hint via
  InboundOption.WgDns); inert at the Xray layer.
- Public sub page now shows the WireGuard config, rebuilt from the share link;
  the Go wireguard:// link carries dns/presharedkey/keepalive for completeness.
- QR enabled for the wireguard:// link; link rows are compact like other protocols.
- Client information order is subscription, copy URL, WireGuard config; the
  redundant config tab is removed from the add/edit client modal.
- Drop the Inbound Information and QR Code row actions for WireGuard inbounds.

frontend/src/test/wireguard-client-config.test.ts

@@ -0,0 +1,55 @@
+import { describe, expect, it } from 'vitest';
+
+import { buildWireguardClientConfig } from '@/pages/clients/wireguardConfig';
+import type { ClientRecord, InboundOption } from '@/hooks/useClients';
+
+const client: ClientRecord = {
+  email: 'alice',
+  privateKey: 'QGVlb2dXc1ZTWGw0ZXBzZndsWmtMaUM5MUlNYjBHWFdYbz0=',
+  allowedIPs: '10.0.0.2/32',
+  preSharedKey: 'cHNrLXZhbHVlLWZvci13aXJlZ3VhcmQtdGVzdC1jYXNlIQ==',
+  keepAlive: 25,
+  inboundIds: [90],
+};
+
+const inbound: InboundOption = {
+  id: 90,
+  tag: 'in-51820-udp',
+  remark: 'wg-mc',
+  protocol: 'wireguard',
+  port: 51820,
+  wgPublicKey: 'DGSYIcEKAUkA7HhzGSjxLZuV67BR3LeyU0BMLJzNVHQ=',
+  wgMtu: 1420,
+};
+
+describe('buildWireguardClientConfig', () => {
+  it('emits the canonical PresharedKey key, not PreSharedKey', () => {
+    const cfg = buildWireguardClientConfig(client, inbound, 'example.com', '');
+    expect(cfg).toContain(`PresharedKey = ${client.preSharedKey}`);
+    expect(cfg).not.toContain('PreSharedKey =');
+  });
+
+  it('defaults DNS to 1.1.1.1, 1.0.0.1 when the inbound sets none', () => {
+    const cfg = buildWireguardClientConfig(client, inbound, 'example.com', '');
+    expect(cfg).toContain('DNS = 1.1.1.1, 1.0.0.1');
+  });
+
+  it('uses the inbound DNS override when present', () => {
+    const cfg = buildWireguardClientConfig(client, { ...inbound, wgDns: '9.9.9.9' }, 'example.com', '');
+    expect(cfg).toContain('DNS = 9.9.9.9');
+    expect(cfg).not.toContain('DNS = 1.1.1.1, 1.0.0.1');
+  });
+
+  it('builds the endpoint from host, port, MTU and server public key', () => {
+    const cfg = buildWireguardClientConfig(client, inbound, 'example.com', '');
+    expect(cfg).toContain('Endpoint = example.com:51820');
+    expect(cfg).toContain('MTU = 1420');
+    expect(cfg).toContain(`PublicKey = ${inbound.wgPublicKey}`);
+    expect(cfg).toContain('PersistentKeepalive = 25');
+  });
+
+  it('omits the PresharedKey line when the client has no preshared key', () => {
+    const cfg = buildWireguardClientConfig({ ...client, preSharedKey: undefined }, inbound, 'example.com', '');
+    expect(cfg).not.toContain('PresharedKey');
+  });
+});