feat(mtproto): adopt dolonet/mtg-multi and make MTProto inbounds multi-client

Replace the upstream 9seconds/mtg sidecar with the dolonet/mtg-multi fork so a single MTProto inbound can serve many per-user secrets. Each panel client is now one named FakeTLS secret in the fork's [secrets] section: clients are first-class (attach/detach, limits, expiry, per-client tg:// links) exactly like every other protocol, mirroring the WireGuard multi-client model. Per-client traffic and online status come from the fork's /stats JSON API (its Prometheus output has no per-user label), fed into the existing email-keyed client_traffics accumulator; an optional throttle caps concurrent connections. A one-time seeder converts each legacy single-secret inbound into a one-client inbound.

The fork ships only linux/darwin amd64/arm64 binaries but is pure Go, so provisioning builds it from source for every supported platform (release.yml, DockerInit.sh) while keeping the panel-expected mtg-<os>-<arch> filename and the 'run' verb, so process.go is untouched. Also fixes a pre-existing update.sh gap that never renamed the mtg binary for armv6/armv7 updates.

frontend/src/schemas/protocols/inbound/mtproto.ts

@@ -10,18 +10,41 @@ export const MtprotoDomainFrontingSchema = z.object({
 });
 export type MtprotoDomainFronting = z.infer<typeof MtprotoDomainFrontingSchema>;
 
-// MTProto (Telegram) inbound. Served by an mtg sidecar process, not Xray, so
-// it has no clients and no stream settings. `secret` is the FakeTLS secret
-// (ee-prefixed); the backend rebuilds it to match `fakeTlsDomain` on save.
-// The remaining fields map to optional mtg config knobs and are written to the
-// generated mtg.toml only when set.
+// An MTProto (Telegram) inbound client (multi-client model). Each client is one
+// named FakeTLS secret the mtg-multi sidecar serves through its [secrets]
+// section; `secret` is the ee-prefixed FakeTLS secret whose trailing domain the
+// backend rebuilds on save. `fakeTlsDomain` is stored on the inbound as the
+// default domain used when generating a new client's secret.
+export const MtprotoClientSchema = z.object({
+  secret: z.string().default(''),
+  email: z.string().min(1),
+  limitIp: z.number().int().min(0).default(0),
+  totalGB: z.number().int().min(0).default(0),
+  expiryTime: z.number().int().default(0),
+  enable: z.boolean().default(true),
+  tgId: z.union([z.number(), z.string()]).transform((v) => Number(v) || 0).default(0),
+  subId: z.string().default(''),
+  comment: z.string().default(''),
+  reset: z.number().int().min(0).default(0),
+  created_at: z.number().int().optional(),
+  updated_at: z.number().int().optional(),
+});
+export type MtprotoClient = z.infer<typeof MtprotoClientSchema>;
+
+// MTProto (Telegram) inbound. Served by an mtg-multi sidecar process, not Xray,
+// so it has no stream settings. Each client carries its own FakeTLS secret and
+// is served on the shared inbound port. The remaining fields map to optional mtg
+// config knobs and are written to the generated mtg config only when set.
 export const MtprotoInboundSettingsSchema = z.object({
   fakeTlsDomain: z.string().default('www.cloudflare.com'),
-  secret: z.string().default(''),
+  clients: z.array(MtprotoClientSchema).default([]),
   proxyProtocolListener: z.boolean().optional(),
   preferIp: z.enum(['prefer-ipv6', 'prefer-ipv4', 'only-ipv6', 'only-ipv4']).optional(),
   debug: z.boolean().optional(),
   domainFronting: MtprotoDomainFrontingSchema.optional(),
+  // Caps concurrent connections across all users with a fair-share algorithm;
+  // 0 or unset disables throttling.
+  throttleMaxConnections: z.number().int().min(0).optional(),
   // When set, the mtg sidecar dials Telegram through a loopback SOCKS bridge in
   // the Xray config so the egress obeys routing rules. `outboundTag` optionally
   // forces that traffic out a specific outbound/balancer. `routeXrayPort` is the