fix(node): apply a pushed inbound's client changes in place instead of rebuilding it

A master pushes the whole inbound to its node whenever a client on it is
auto-disabled, renewed or reset, and the node-sync reconcile re-sends every
inbound whose payload changed (all of them after a master restart). The
node's UpdateInbound answered every push with DelInbound + AddInbound, so
Xray closed the listener and every open connection on that port dropped.
On a node inbound with ~2,700 clients that was dozens of times a day.

UpdateInbound now diffs the config Xray is running against the new one.
When only settings.clients differ (vless, vmess, trojan, hysteria, masque)
it applies per-user RemoveUser/AddUser through the runtime, and when
nothing the core sees changed it does nothing. Any other change, or any
per-user failure (a handler the core lost included), still rebuilds as
before. AmneziaWG joins MTProto and TUIC on rt.UpdateInbound, whose
in-place Ensure keeps the device and its peers; Del+Add tore it down.

A pushed removal does not consult the node's own
restartXrayOnClientDisable: it defaults to on, and the master already
restarts its nodes from its own setting (restartRemoteNodesOnDisable).
Nodes on an older release keep rebuilding until they update; the master
side needs no change.

Verified: the new service tests, TestXrayAPI_E2E_Users against a real
core (pins the missing-user vs missing-handler error texts) and make
node-e2e. make race not run: no goroutine, lock or shared state changed.

Closes #6795

internal/xray/hot_diff.go

@@ -221,6 +221,19 @@ func droppedClients(oldIb, newIb *InboundConfig) []UserOp {
 	return dropped
 }
 
+// InboundUserOps returns the per-user ops that bring a running inbound from oldIb
+// to newIb; ok is false when only rebuilding its handler can apply the change.
+func InboundUserOps(oldIb, newIb *InboundConfig) (*HotDiff, bool) {
+	diff := &HotDiff{}
+	if inboundEqualNormalized(oldIb, newIb) {
+		return diff, true
+	}
+	if !diffInboundUsers(oldIb, newIb, diff) {
+		return nil, false
+	}
+	return diff, true
+}
+
 var userDiffableProtocols = map[string]struct{}{"vless": {}, "vmess": {}, "trojan": {}, "hysteria": {}, "masque": {}}
 
 // diffInboundUsers emits per-user AlterInbound ops when two same-tag inbounds