fix(outbounds): prevent freedom save crash, complete its fields (#4686)

freedomToWire called Object.entries(s.fragment), but getFieldsValue(true)
returns freedom settings without a fragment object when the Fragment switch
is off (its sub-fields never register). That threw 'Cannot convert undefined
or null to object' and silently killed the save. Guard fragment with a
fallback so an unset value is treated as empty.

While verifying against xray-core's freedom config, also:
- add the missing userLevel field (schema, form schema, adapter, UI)
- fix noise applyTo enum to ip/ipv4/ipv6 (xray rejects the old host/all)

Closes #4686

frontend/src/schemas/protocols/outbound/freedom.ts

@@ -26,7 +26,7 @@ export const FreedomFragmentSchema = z.object({
 export type FreedomFragment = z.infer<typeof FreedomFragmentSchema>;
 
 export const FreedomNoiseTypeSchema = z.enum(['rand', 'str', 'base64', 'hex']);
-export const FreedomNoiseApplyToSchema = z.enum(['ip', 'host', 'all']);
+export const FreedomNoiseApplyToSchema = z.enum(['ip', 'ipv4', 'ipv6']);
 
 export const FreedomNoiseSchema = z.object({
   type: FreedomNoiseTypeSchema.default('rand'),
@@ -52,6 +52,7 @@ export type FreedomFinalRule = z.infer<typeof FreedomFinalRuleSchema>;
 export const FreedomOutboundSettingsSchema = z.object({
   domainStrategy: OutboundDomainStrategySchema.optional(),
   redirect: z.string().optional(),
+  userLevel: z.number().int().min(0).optional(),
   proxyProtocol: z.number().optional(),
   fragment: FreedomFragmentSchema.optional(),
   noises: z.array(FreedomNoiseSchema).optional(),