feat(reality): warn when target cert chain is too small for ML-DSA-65 (#6470)

* feat(reality): warn when target cert chain is too small for ML-DSA-65

Expose peer cert-chain DER size from the REALITY scanner and surface a UI
warning when ML-DSA-65 is enabled but the chain is under xray-core's 3500-byte
minimum, so silent fallback failures are easier to catch.

Fixes #5973

* fix(reality): gate scanner ML-DSA tag and sync docs OpenAPI

Only warn on short cert chains in the target scanner when ML-DSA-65 is
enabled. Copy frontend/public/openapi.json to docs/public/openapi.json
and fix oxfmt wrapping in the new test.

---------

Co-authored-by: mrchatam <287639636+mrchatam@users.noreply.github.com>

internal/web/service/reality_scan.go

@@ -57,7 +57,10 @@ type RealityScanResult struct {
 	CertValid     bool   `json:"certValid" example:"true"`
 	// CertChainValid ignores the name: a trusted chain presented for other names
 	// still has serverNames the panel can offer instead of the failing SNI.
-	CertChainValid bool     `json:"certChainValid" example:"true"`
+	CertChainValid bool `json:"certChainValid" example:"true"`
+	// CertChainBytes is the sum of DER lengths of the presented peer chain.
+	// xray-core ML-DSA-65 REALITY needs >= 3500 bytes (constant lives in xray-core).
+	CertChainBytes int      `json:"certChainBytes" example:"3427"`
 	CertSubject    string   `json:"certSubject" example:"cloudflare.com"`
 	CertIssuer     string   `json:"certIssuer" example:"Google Trust Services"`
 	NotAfter       string   `json:"notAfter" example:"2026-08-01T00:00:00Z"`
@@ -253,6 +256,9 @@ func (s *ServerService) probeRealityAddr(dialHost string, port int, sni string,
 	verifyHost := sni
 	if len(st.PeerCertificates) > 0 {
 		leaf := st.PeerCertificates[0]
+		for _, cert := range st.PeerCertificates {
+			res.CertChainBytes += len(cert.Raw)
+		}
 		res.CertSubject = leaf.Subject.CommonName
 		if res.CertSubject == "" && len(leaf.DNSNames) > 0 {
 			res.CertSubject = leaf.DNSNames[0]