feat(xray): update xray-core to v26.9.30 and adapt panel

Bump xtls/xray-core to b26a91de4f (v26.9.30) and the three binary pins
(DockerInit.sh, release.yml Linux + Windows) in lockstep. No deleted
symbols; the sing and sing-shadowsocks indirect deps drop out with the
SS2022 rewrite.

XDNS finalmask (#6718) replaced its string lists with objects: domains
are {name, types, edns0, lenLimit, labelLimit} and client resolvers
{type, settings.addr}. The loader no longer parses the old lists, so a
single stored xdns mask keeps the whole core from starting. The new leaf
package internal/util/maskcompat converts them: "name[:type]" becomes a
domain and "name[:type]+udp://addr" a domain plus a udp resolver. A bare
name maps to TXT, the type legacy clients queried by default, and each
converted domain keeps the 1232-byte EDNS0 the old code always used
(without it the server caps answers at 512). It runs from:
- the XdnsFinalmaskObjectsFix seeder, over inbound streams, hosts, the
  xray template, the global sub-JSON mask and cached subscription
  outbounds;
- inbound save (normalizeStreamSettings) and GetXrayConfig, for rows
  that never went through the seeder;
- both link importers, since fm= from an older panel carries the lists.
The finalmask form edits the object shape (every key needs a registered
field, or the finalmask watch drops it on save) and lifts legacy masks
on open. The udp-mask golden fixture moves to the object shape, which
TestGoldenStreamFixturesBuildInXray now builds through the core. The
wire format changed as well, so pre-upgrade clients need the new core.

WireGuard outbound (#6771) dropped settings.domainStrategy and the
remoteDNS "local" mode. The endpoint lookup now follows
sockopt.domainStrategy and in-tunnel targets the outbound's
targetStrategy. The old key is silently ignored, which undid the
IPv4-first endpoint lookup the WARP outbound depends on (#5205), and
"local" now panics the core at startup because remoteDNS goes through
netip.MustParseAddr. The WireguardDomainStrategyFix seeder moves a stored
family preference to both keys (a value already set wins) and turns
"local" into targetStrategy; the outbound form lifts legacy rows the same
way and drops its select, the WARP modal writes the new placement, and
the inbound form loses a field the server never read.
ValidateOutboundConfig now refuses a non-IP remoteDNS entry, which
conf.Build() lets through, on template save and for outbound
subscriptions.

Noise finalmask items accept type "exp" (#6862), a tag expression. The
form offers it for noise items only: header-custom items go through the
core's PraseByteSlice, which refuses it.

TUN gained autoSystemDnsToGateway (Linux) and autoSystemWfpBlockLeak
(Windows). Both pass through the settings schema so a value set in JSON
survives the next form save.

MASQUE (inbound, outbound, transport) and the XDRIVE transport are new
protocols the panel does not offer yet; their new loader refusals only
cover configs the panel never generates. The FakeDNS IPv6 pool default,
the SS2022 rewrite (same gRPC account; emails are now deduped
case-insensitively, as the panel already does), the restored udphop
interval default and the rest change no panel-facing config.

frontend/src/schemas/protocols/inbound/tun.ts

@@ -8,5 +8,8 @@ export const TunInboundSettingsSchema = z.object({
   userLevel: z.number().int().min(0).default(0),
   autoSystemRoutingTable: z.array(z.string()).default([]),
   autoOutboundsInterface: z.string().default('auto'),
+  // xray-core 26.9.30: the first acts on Linux, the second ("dns", "misconfigtun") on Windows.
+  autoSystemDnsToGateway: z.boolean().optional(),
+  autoSystemWfpBlockLeak: z.array(z.string()).optional(),
 });
 export type TunInboundSettings = z.infer<typeof TunInboundSettingsSchema>;

frontend/src/schemas/protocols/inbound/wireguard.ts

@@ -1,14 +1,5 @@
 import { z } from 'zod';
 
-export const WireguardDomainStrategySchema = z.enum([
-  'ForceIP',
-  'ForceIPv4',
-  'ForceIPv4v6',
-  'ForceIPv6',
-  'ForceIPv6v4',
-]);
-export type WireguardDomainStrategy = z.infer<typeof WireguardDomainStrategySchema>;
-
 // AntD InputNumber emits null (not undefined) when the user clears it, and
 // the form store hands that null straight to safeParse on submit — a bare
 // .optional() would reject it and block the save.
@@ -68,7 +59,6 @@ export const WireguardInboundSettingsSchema = z.object({
   peers: z.array(WireguardInboundPeerSchema).default([]),
   clients: z.array(WireguardClientSchema).default([]),
   noKernelTun: z.boolean().default(false),
-  domainStrategy: WireguardDomainStrategySchema.optional(),
   // Admin-configurable base subnet new clients are auto-allocated from —
   // mirrors AmneziaWG's settings.server.subnetIp/subnetCidr. Optional and
   // left blank by default: an inbound that never sets this keeps the

frontend/src/schemas/protocols/outbound/wireguard.ts

@@ -1,14 +1,5 @@
 import { z } from 'zod';
 
-export const WireguardDomainStrategySchema = z.enum([
-  'ForceIP',
-  'ForceIPv4',
-  'ForceIPv4v6',
-  'ForceIPv6',
-  'ForceIPv6v4',
-]);
-export type WireguardDomainStrategy = z.infer<typeof WireguardDomainStrategySchema>;
-
 export const WireguardOutboundPeerSchema = z.object({
   publicKey: z.string().min(1),
   preSharedKey: z.string().optional(),
@@ -22,7 +13,6 @@ export const WireguardOutboundSettingsSchema = z.object({
   mtu: z.number().int().min(1).optional(),
   secretKey: z.string().min(1),
   address: z.array(z.string()).default([]),
-  domainStrategy: WireguardDomainStrategySchema.optional(),
   reserved: z.array(z.number().int()).optional(),
   peers: z.array(WireguardOutboundPeerSchema).min(1),
   noKernelTun: z.boolean().default(false),