fix(sub): resolve a blank subId to no subscription

A subId is the only selector of a subscription's inbounds and external
links, so a blank one matched every client stored without a subId, as
clients embedded through inbounds/add or inbounds/import are. The
Telegram bot authorised a client by email and then looked its links up
by that blank subId, handing a bound user the working links of every
other subId-less client.

A blank subId now resolves to nothing in the subscription service, and
the bot builds a subId-less client's own links by email, as the panel's
client page does.

internal/sub/service.go

@@ -737,8 +737,12 @@ func subscriptionExpiryFromClient(nowMs, expiryTime int64) int64 {
 	return 0
 }
 
-// getInboundsBySubId loads the subscriber's inbounds; hosts are read per request, never cached.
+// getInboundsBySubId loads the subscriber's inbounds, hosts read per request; a blank subId
+// would match every client stored without one, so it names no subscription.
 func (s *SubService) getInboundsBySubId(subId string) ([]*model.Inbound, error) {
+	if strings.TrimSpace(subId) == "" {
+		return nil, nil
+	}
 	inbounds, err := s.loadInboundsBySubId(subId)
 	if err != nil {
 		return nil, err