feat(sub): add Incy app-management parameters (#6650)

* feat(sub): add Incy app-management parameters

The panel already pushes a set of Happ headers, but INCY documents its own
lowercase header names and its own value domains, so a Happ-shaped payload gets
ignored by the client (per-app mode is bypass|proxy, not on|bypass, and
per-app-proxy-enable has no Happ counterpart at all). Add a sibling Incy path
that emits exactly the documented headers.

Covered, per https://docs.incy.cc/en/app-management/:
- profile-description, sort-order, support-email, announce-url, premium-url
- banner text/button/URL and the two hex colours
- hide-url, hide-check, no-limit-enabled
- per-app split tunnelling (enable/mode/list)
- TCP fragmentation (enable/length/interval/packets)
- UDP noise packets (enable/type/packet/delay)
- DoH pre-resolution (enable/domain/IP)

Each string setting is tri-state: an empty value omits the header, so an
untouched panel never overrides the subscriber's own choice in the app. Values
are validated against the documented domains and dropped when they do not
match, and non-ASCII text is base64-wrapped the way the docs require for
Cyrillic. INCY identifies itself as INCY/<version>/<platform>, which gates the
headers behind the same auto-detect switch the Happ path uses.

Headers the panel already emits for every client (Profile-Title, Support-Url,
Profile-Web-Page-Url, Announce, Profile-Update-Interval, Subscription-Userinfo)
and Incy's routing line are left as they are.

The Premium API (theme, defaultPingProtocol, fallbackHosts, ...) is a separate
encrypted endpoint and stays out of scope here.

* fix(sub): keep Incy per-app list entries separate on the wire

The Incy settings textarea takes one package per line, as Incy documents for
per-app-proxy-list, but the header path ran the value through
sanitizeHeaderValue, which deletes CR/LF. "com.google.chrome\norg.telegram.messenger"
reached the client as the single bogus package
"com.google.chromeorg.telegram.messenger", so per-app split tunnelling silently
matched no app. Join comma- or line-separated entries as CSV instead.

Also drop three tests that could not fail: TestIncyExcludesHappOnlyHeaders
(ApplyIncyHeaders has no path that emits Happ headers, and the non-Happ UA
gate is already pinned by TestApplyHappHeaders_Gating) and two UI tests that
only asserted updateSetting received the key the JSX passes it.

---------

Co-authored-by: DIMFLIX <dimflix@users.noreply.github.com>
Co-authored-by: MHSanaei <ho3ein.sanaei@gmail.com>

internal/web/translation/id-ID.json

@@ -1670,7 +1670,76 @@
       "discordNotifyTimeDesc": "Seberapa sering bot Discord mengirim laporan berkala. Pilih interval siap pakai, atau pilih Kustom untuk memasukkan ekspresi crontab.",
       "discordNotifyBackup": "Cadangan Database",
       "discordNotifyBackupDesc": "Kirim berkas cadangan database dengan laporan.",
-      "discordEventBusNotifyDesc": "Pilih peristiwa yang memicu notifikasi Discord"
+      "discordEventBusNotifyDesc": "Pilih peristiwa yang memicu notifikasi Discord",
+      "subIncyAppAutoDetect": "Deteksi otomatis header Incy",
+      "subIncyAppAutoDetectDesc": "Kirim header Incy saat User-Agent klien adalah INCY.",
+      "subIncyNotSet": "Tidak diatur",
+      "subIncyOn": "Aktif",
+      "subIncyOff": "Nonaktif",
+      "subIncyGroupApp": "Aplikasi",
+      "subIncyProfileDescription": "Deskripsi profil",
+      "subIncyProfileDescriptionDesc": "Deskripsi langganan terpisah. Teks non-ASCII dikirim sebagai base64.",
+      "subIncySortOrder": "Urutan server",
+      "subIncySortOrderDesc": "Untuk langganan ini di iOS/Android, global di desktop.",
+      "subIncySortNone": "Urutan langganan",
+      "subIncySortPing": "Menurut ping",
+      "subIncySortName": "Menurut nama",
+      "subIncySupportEmail": "Email dukungan",
+      "subIncySupportEmailDesc": "Menambahkan tombol Email di kartu langganan.",
+      "subIncyAnnounceUrl": "Tautan pengumuman",
+      "subIncyAnnounceUrlDesc": "Tujuan tautan pengumuman di layar utama.",
+      "subIncyPremiumUrl": "Tautan Premium",
+      "subIncyPremiumUrlDesc": "Tombol Premium di kartu; juga diprioritaskan untuk tombol banner.",
+      "subIncyGroupBanners": "Banner",
+      "subIncyBannerText": "Teks banner",
+      "subIncyBannerTextDesc": "Menimpa teks banner. Hanya untuk penyedia premium.",
+      "subIncyBannerButtonText": "Teks tombol banner",
+      "subIncyBannerButtonTextDesc": "Label tombol banner. Kosong menyembunyikan tombol.",
+      "subIncyBannerButtonUrl": "Tautan tombol banner",
+      "subIncyBannerButtonUrlDesc": "URL tombol banner.",
+      "subIncyBannerBgColor": "Latar banner",
+      "subIncyBannerBgColorDesc": "Warna hex, mis. #E53E3E.",
+      "subIncyBannerButtonColor": "Warna tombol banner",
+      "subIncyBannerButtonColorDesc": "Warna hex, mis. #38A169.",
+      "subIncyGroupPrivacy": "Privasi",
+      "subIncyHideUrl": "Sembunyikan URL langganan",
+      "subIncyHideUrlDesc": "Menyembunyikan URL dari Bagikan, Salin, QR, dan cadangan.",
+      "subIncyHideCheck": "Sembunyikan tombol Check",
+      "subIncyHideCheckDesc": "Menghapus tombol pemeriksaan koneksi dari layar utama.",
+      "subIncyNoLimit": "Mode No-Limit (iOS)",
+      "subIncyNoLimitDesc": "Mode hemat memori agar tunnel tetap hidup di bawah batas 50 MB iOS.",
+      "subIncyPerAppEnable": "Mode per-app (Android)",
+      "subIncyPerAppEnableDesc": "Mengaktifkan split tunnel per aplikasi. Nonaktif menimpa pilihan pengguna.",
+      "subIncyPerAppMode": "Jenis mode per-app",
+      "subIncyPerAppModeDesc": "proxy: hanya aplikasi terdaftar lewat VPN; bypass: sebaliknya.",
+      "subIncyPerAppModeProxy": "Hanya aplikasi terdaftar",
+      "subIncyPerAppModeBypass": "Aplikasi terdaftar dilewati",
+      "subIncyPerAppList": "Daftar aplikasi",
+      "subIncyPerAppListDesc": "Nama paket dipisah koma atau baris baru, atau URL ke berkas teks.",
+      "subIncyGroupNetwork": "Jaringan",
+      "subIncyFragmentationEnable": "Fragmentasi",
+      "subIncyFragmentationEnableDesc": "Mengaktifkan fragmentasi TCP dan menimpa pengaturan global.",
+      "subIncyFragmentLength": "Panjang fragmen",
+      "subIncyFragmentLengthDesc": "Rentang dalam byte, mis. 10-30.",
+      "subIncyFragmentInterval": "Interval fragmen",
+      "subIncyFragmentIntervalDesc": "Rentang dalam milidetik, mis. 20-40.",
+      "subIncyFragmentPackets": "Paket fragmen",
+      "subIncyFragmentPacketsDesc": "Paket TCP mana yang difragmentasi: tlshello, 1-3, 1, atau all.",
+      "subIncyNoisesEnable": "Paket noise",
+      "subIncyNoisesEnableDesc": "Mengirim noise UDP acak sebelum handshake VPN.",
+      "subIncyNoisesType": "Jenis noise",
+      "subIncyNoisesTypeDesc": "rand, str, atau hex.",
+      "subIncyNoisesPacket": "Isi paket noise",
+      "subIncyNoisesPacketDesc": "Muatan; untuk rand berupa rentang panjang, mis. 10-20.",
+      "subIncyNoisesDelay": "Jeda noise",
+      "subIncyNoisesDelayDesc": "Rentang jeda dalam milidetik, mis. 10-50.",
+      "subIncyResolveEnable": "Resolusi alamat server (DoH)",
+      "subIncyResolveEnableDesc": "Meresolusi alamat server via DoH sebelum terhubung.",
+      "subIncyResolveDnsDomain": "Endpoint DoH",
+      "subIncyResolveDnsDomainDesc": "URL server DoH, biasanya berakhiran /dns-query.",
+      "subIncyResolveDnsIp": "IP server DoH",
+      "subIncyResolveDnsIpDesc": "IP server DoH untuk bootstrap.",
+      "subIncyGroupRouting": "Perutean"
     },
     "xray": {
       "save": "Simpan",