refactor(amneziawg): route via Xray through the stock Routing page, not custom toggles

Simplifies RouteViaXray after realizing the panel already has everything
needed: the Routing page already lets an admin pick a source inbound tag
and a target outbound (plus, if they want it, a specific source IP) for
any protocol. Bolting a parallel routeThroughXray/routeOutboundTag pair
onto both the client and inbound forms duplicated that mechanism instead
of using it.

Removed entirely: Client/ClientRecord/ServerSettings/Peer's
RouteThroughXray + RouteOutboundTag fields, the effective-routing OR/
fallback logic in InstanceFromInbound, and the Switch+Select UI on both
forms. Nothing configures "route via Xray" as a setting anymore.

In its place, every enabled AmneziaWG inbound now gets its own Xray
TPROXY bridge unconditionally, by default, no toggle:

- internal/amneziawg: every peer's traffic is always TPROXY'd into that
  instance's own bridge (defaultPostUpDown, port derived from the
  inbound's id via EgressPortForInbound so the kernel side and the
  Xray-config side never need to negotiate a runtime value). Since the
  TPROXY rule is now tied to a peer's mere presence rather than an
  opt-in flag, hostRulesFingerprint now covers every peer unconditionally
  (add/remove/re-IP forces a restart, the same way ForwardedPorts always
  did) instead of skipping peers with nothing to opt into.
- internal/web/service/xray.go's injectAmneziawgEgress creates one
  dokodemo-door bridge per qualifying inbound, tagged with that inbound's
  own real tag — the same trick injectMtprotoEgress already uses (reusing
  a real inbound's tag), which is why it's already selectable in the
  panel's Routing page: InboundService.GetInboundTags() is a plain,
  protocol-blind SELECT over every inbound row's tag, no dedicated UI
  plumbing needed. The function never generates a routing rule itself
  anymore — where (if anywhere) that traffic goes is entirely up to
  whatever rules the admin adds through the existing Routing UI.

Frontend: no new UI at all. Tests rewritten to match — one bridge per
inbound with its own tag/port, no rule generation, no opt-in gating.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

frontend/public/openapi.json

@@ -1095,14 +1095,6 @@
             "description": "VLESS simple reverse proxy settings",
             "nullable": true
           },
-          "routeOutboundTag": {
-            "description": "Xray outbound/balancer tag this peer's TPROXY'd traffic routes to; empty uses Xray's default routing",
-            "type": "string"
-          },
-          "routeThroughXray": {
-            "description": "AmneziaWG: TPROXY this peer's traffic into Xray",
-            "type": "boolean"
-          },
           "secret": {
             "example": "ee1234567890abcdef1234567890abcd7777772e636c6f7564666c6172652e636f6d",
             "type": "string"
@@ -1231,12 +1223,6 @@
             "type": "integer"
           },
           "reverse": {},
-          "routeOutboundTag": {
-            "type": "string"
-          },
-          "routeThroughXray": {
-            "type": "boolean"
-          },
           "secret": {
             "type": "string"
           },
@@ -1283,8 +1269,6 @@
           "publicKey",
           "reset",
           "reverse",
-          "routeOutboundTag",
-          "routeThroughXray",
           "secret",
           "security",
           "subId",
@@ -2878,13 +2862,6 @@
           "publicKey": {
             "type": "string"
           },
-          "routeOutboundTag": {
-            "type": "string"
-          },
-          "routeThroughXray": {
-            "description": "RouteThroughXray, when true, is the inbound-wide default: every peer\nTPROXYs into Xray unless it explicitly turns its own RouteThroughXray\noff... except a plain bool can't distinguish \"peer left it unset\" from\n\"peer explicitly opted out\", so in practice this ORs with each peer's\nown flag (see Peer.RouteThroughXray) — turning this on routes every\npeer, turning it off still lets individual peers opt in on their own.\nRouteOutboundTag is the default outbound/balancer tag used when a\nrouted peer didn't set its own; empty means Xray's default routing.",
-            "type": "boolean"
-          },
           "s1": {
             "type": "integer"
           },