feat(mtproto): adopt dolonet/mtg-multi and make MTProto inbounds multi-client

Replace the upstream 9seconds/mtg sidecar with the dolonet/mtg-multi fork so a single MTProto inbound can serve many per-user secrets. Each panel client is now one named FakeTLS secret in the fork's [secrets] section: clients are first-class (attach/detach, limits, expiry, per-client tg:// links) exactly like every other protocol, mirroring the WireGuard multi-client model. Per-client traffic and online status come from the fork's /stats JSON API (its Prometheus output has no per-user label), fed into the existing email-keyed client_traffics accumulator; an optional throttle caps concurrent connections. A one-time seeder converts each legacy single-secret inbound into a one-client inbound.

The fork ships only linux/darwin amd64/arm64 binaries but is pure Go, so provisioning builds it from source for every supported platform (release.yml, DockerInit.sh) while keeping the panel-expected mtg-<os>-<arch> filename and the 'run' verb, so process.go is untouched. Also fixes a pre-existing update.sh gap that never renamed the mtg binary for armv6/armv7 updates.

frontend/src/test/link-label.test.ts

@@ -26,4 +26,18 @@ describe('link-label parseLinkParts', () => {
   it('returns null for an unparseable scheme', () => {
     expect(parseLinkParts('not-a-link')).toBeNull();
   });
+
+  // MTProto share links are tg://proxy deep links whose port rides in a query
+  // param, not the URL authority; they carry no transport and use FakeTLS.
+  it('labels an mtproto tg://proxy link with its query-param port and FakeTLS', () => {
+    const parts = parseLinkParts(
+      'tg://proxy?server=host.example.com&port=8443&secret=ee00#mt-inbound',
+    );
+    expect(parts?.protocol).toBe('MTProto');
+    expect(parts?.network).toBe('');
+    expect(parts?.security).toBe('FAKETLS');
+    expect(parts?.port).toBe('8443');
+    expect(parts?.remark).toBe('mt-inbound');
+    expect(parts && linkMetaText(parts)).toBe('mt-inbound:8443');
+  });
 });