fix(xray): block private-range egress in per-peer AmneziaWG IPv6 outbounds

The per-peer IPv6 freedom outbounds the panel injects for AmneziaWG
clients were built with empty settings and their routing rule sits
ahead of the template's private-range block, so a peer's IPv6 traffic
skipped both layers and could reach fc00::/7 hosts on the panel's
network.

Each per-peer outbound now carries the same private-range finalRules
block every other freedom outbound gets.

internal/web/service/xray.go

@@ -962,6 +962,17 @@ func amneziawgV6EgressTag(inboundID int, email string) string {
 	return fmt.Sprintf("amneziawg-v6-%d-%s", inboundID, email)
 }
 
+// amneziawgV6EgressSettings carries the template's private-range egress block:
+// the per-peer rule is matched ahead of the routing-level geoip:private rule.
+func amneziawgV6EgressSettings() map[string]any {
+	return map[string]any{
+		"finalRules": []any{
+			map[string]any{"action": "block", "ip": []any{"geoip:private"}},
+			map[string]any{"action": "allow"},
+		},
+	}
+}
+
 // injectAmneziawgV6Egress gives every enabled, non-node-hosted AmneziaWG
 // peer with an IPv6 AllowedIPs entry its own single-purpose freedom
 // outbound, bound via sendThrough to that exact address, plus a routing
@@ -1061,7 +1072,7 @@ func injectAmneziawgV6Egress(cfg *xray.Config, inbounds []*model.Inbound) {
 				"tag":         tag,
 				"protocol":    "freedom",
 				"sendThrough": v6,
-				"settings":    map[string]any{},
+				"settings":    amneziawgV6EgressSettings(),
 			})
 			newRules = append(newRules, map[string]any{
 				"type":        "field",