feat(amneziawg): support persistent keepalive ranges (#6881)

AmneziaWG clients accept a randomised PersistentKeepalive range such as 15-25,
which makes keepalive timing harder to fingerprint; the panel only stored a
single number. A client's keepalive may now be a range, validated the way
AmneziaWG parses it. The downloadable .conf and vpn:// profile carry the range,
Clash/Mihomo output gets its lower bound, and plain WireGuard stays scalar-only.
The range lives in an additive wg_keep_alive_range column, so the integer
column and an older panel binary keep working after a rollback.

frontend/src/schemas/client.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { OptionalClientKeepAliveSchema } from '@/schemas/primitives/keepalive';
 
 const nullableStringArray = z
   .array(z.string())
@@ -52,7 +53,7 @@ export const ClientRecordSchema = z
     publicKey: z.string().optional(),
     allowedIPs: z.string().optional(),
     preSharedKey: z.string().optional(),
-    keepAlive: z.number().optional(),
+    keepAlive: OptionalClientKeepAliveSchema,
     forwardedPorts: z.string().optional(),
     secret: z.string().optional(),
     adTag: z.string().optional(),

frontend/src/schemas/primitives/keepalive.ts

@@ -0,0 +1,40 @@
+import { z } from 'zod';
+
+const invalidKeepAlive = 'pages.clients.amneziaWgKeepAliveInvalid';
+const MAX_KEEPALIVE_SECONDS = 65535;
+
+export const AmneziaWGKeepAliveRangeSchema = z.string().refine((value) => {
+  if (!/^(0|[1-9]\d*)-(0|[1-9]\d*)$/.test(value)) return false;
+  const [minimum, maximum] = value.split('-').map(Number);
+  return minimum >= 0 && minimum <= maximum && maximum <= MAX_KEEPALIVE_SECONDS;
+}, invalidKeepAlive);
+
+// Numeric values stay permissive here so older stored values remain readable.
+export const ClientKeepAliveSchema = z.union([z.number(), AmneziaWGKeepAliveRangeSchema]);
+export const OptionalClientKeepAliveSchema = z.preprocess(
+  (value) => (value == null ? undefined : value),
+  ClientKeepAliveSchema.optional(),
+);
+
+const boundedSeconds = z
+  .number()
+  .refine(
+    (value) => Number.isInteger(value) && value >= 0 && value <= MAX_KEEPALIVE_SECONDS,
+    invalidKeepAlive,
+  );
+
+export const OptionalNumericKeepAliveInputSchema = z.preprocess(
+  (value) => (value == null || value === '' ? undefined : value),
+  boundedSeconds.optional(),
+);
+
+export const OptionalAmneziaWGKeepAliveInputSchema = z.preprocess(
+  (value) => (value == null || value === '' ? undefined : value),
+  z.union([boundedSeconds, AmneziaWGKeepAliveRangeSchema]).optional(),
+);
+
+export function keepAliveInputValue(value: unknown): number | string | undefined {
+  if (value == null || value === '') return undefined;
+  const text = String(value);
+  return /^\d+$/.test(text) ? Number(text) : text;
+}

frontend/src/schemas/protocols/inbound/amneziawg.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { OptionalClientKeepAliveSchema } from '@/schemas/primitives/keepalive';
 
 // AntD InputNumber emits null (not undefined) when the user clears it, and
 // the form store hands that null straight to safeParse on submit — a bare
@@ -23,7 +24,7 @@ export const AmneziawgClientSchema = z.object({
   publicKey: z.string().optional(),
   preSharedKey: z.string().optional(),
   allowedIPs: z.array(z.string()).default([]),
-  keepAlive: optionalClearedInt(z.number().int().min(0)),
+  keepAlive: OptionalClientKeepAliveSchema,
   forwardedPorts: z.string().default(''),
   email: z.string().min(1),
   limitIp: z.number().int().min(0).default(0),