fix(inbounds): reject incompatible VLESS fallbacks and prevent Xray crashes (#7003)

Xray refuses a VLESS inbound with server decryption whenever fallbacks is non-nil, even an empty list, so an API or imported inbound with decryption and fallbacks: [] took every inbound down. Empty fallback arrays are now normalized away on add, update, config build and node push; non-empty ones are refused with decryption, enabling decryption over stored fallback rules is refused, and a legacy conflicting row holds back the running core instead of stopping it. The form, API docs and locales follow. Closes #7001.

internal/web/service/fallback.go

@@ -59,8 +59,16 @@ func (s *FallbackService) GetParentForChild(childId int) (*model.InboundFallback
 
 // SetByMaster replaces the master's entire fallback list atomically.
 func (s *FallbackService) SetByMaster(masterId int, items []FallbackInput) error {
-	db := database.GetDB()
-	return db.Transaction(func(tx *gorm.DB) error {
+	return runSerializedTx(func(tx *gorm.DB) error {
+		if len(items) > 0 {
+			var master model.Inbound
+			if err := tx.First(&master, masterId).Error; err != nil {
+				return err
+			}
+			if !inboundCanHostFallbacks(&master) {
+				return fmt.Errorf("inbound %d cannot host fallbacks: use TCP with TLS/REALITY and disable VLESS decryption first", masterId)
+			}
+		}
 		if err := tx.Where("master_id = ?", masterId).Delete(&model.InboundFallback{}).Error; err != nil {
 			return err
 		}