fix(inbounds): keep stored client lifecycle and counters on inbound save

Invariant: saving an inbound's configuration never changes a client's
enable, expiry, quota or renewal state, nor the inbound's own traffic
counters. The inbound modal posts back the whole settings.clients list it
loaded when it opened, and UpdateInbound stored it, synced it into the
client records and wrote it into client_traffics. Any client renewed,
depleted or reset while the modal was open was reverted - a renewed client
came back disabled with its old expiry. The row itself was read before the
serialized tx and saved whole, so traffic the poll added in between was
rolled back and a depleted inbound could be re-enabled.

UpdateInbound now re-reads the row inside the writer and, for clients the
inbound already holds, keeps enable, expiryTime, totalGB, reset, resetDay,
resetWeekday and resetMax from it; those change through the client
endpoints. A master's node-sync push stays authoritative. Existing clients'
lifecycle fields are no longer editable through the inbound JSON editor or
/inbounds/update, which the API docs now state.

internal/web/service/inbound_settings_commit.go

@@ -139,3 +139,48 @@ func mergeClientLists(base, ours, current []any) []any {
 	}
 	return out
 }
+
+// Client limits and state the inbound form never owns: the client endpoints and
+// traffic jobs change them, so a form opened earlier must not write them back.
+var storedClientLifecycleKeys = []string{"enable", "expiryTime", "totalGB", "reset", "resetDay", "resetWeekday", "resetMax"}
+
+// keepStoredClientLifecycle copies those keys from the stored settings onto every
+// payload client the inbound already holds; new clients keep what they carry.
+func keepStoredClientLifecycle(payload, stored string) string {
+	var payloadM, storedM map[string]any
+	if json.Unmarshal([]byte(payload), &payloadM) != nil || json.Unmarshal([]byte(stored), &storedM) != nil {
+		return payload
+	}
+	storedClients, _ := storedM["clients"].([]any)
+	storedBy := indexClientsByEmail(storedClients)
+	payloadClients, _ := payloadM["clients"].([]any)
+	changed := false
+	for _, entry := range payloadClients {
+		p, email := clientEntryEmail(entry)
+		s, known := storedBy[email]
+		if !known {
+			continue
+		}
+		for _, key := range storedClientLifecycleKeys {
+			sv, inStored := s[key]
+			pv, inPayload := p[key]
+			if inStored == inPayload && reflect.DeepEqual(sv, pv) {
+				continue
+			}
+			changed = true
+			if inStored {
+				p[key] = sv
+			} else {
+				delete(p, key)
+			}
+		}
+	}
+	if !changed {
+		return payload
+	}
+	b, err := json.MarshalIndent(payloadM, "", "  ")
+	if err != nil {
+		return payload
+	}
+	return string(b)
+}