fix(node): let a node change only the clients it alone hosts

A node snapshot was merged into the master's client records by email, and
the only ownership check filtered one derived copy of it: the node's
settings were still stored and re-synced later, its stats still merged,
and a record linked to the master as well as the node took every value
the node reported, including credentials rendered into the master's own
Xray config.

Each snapshot now passes one gate before anything is written. A record
also linked to the master or another node keeps the master's values
apart from per-link fields and the lifecycle the merge already settles;
a record linked only elsewhere, a detached record, a padded or
case-variant email and a new client holding another client's subId are
dropped from the stored settings as well. A soft-orphaned record can be
taken back only by the node whose merge orphaned it, which the new
clients.sync_orphaned_by column records. A node tunnel no longer owns
the peer keys of a client a master-local tunnel also serves.

internal/web/service/client_sync_orphan.go

@@ -25,13 +25,13 @@ func clientRecordExists(tx *gorm.DB, email string) bool {
 	return n > 0
 }
 
-func markSyncOrphan(tx *gorm.DB, email string, nowMs int64) error {
+func markSyncOrphan(tx *gorm.DB, email string, nodeID int, nowMs int64) error {
 	if email == "" {
 		return nil
 	}
 	return tx.Model(&model.ClientRecord{}).
 		Where("email = ? AND sync_orphaned_at = 0", email).
-		Update("sync_orphaned_at", nowMs).Error
+		Updates(map[string]any{"sync_orphaned_at": nowMs, "sync_orphaned_by": nodeID}).Error
 }
 
 // A client that is attached again is not orphaned, whatever an earlier merge
@@ -39,7 +39,7 @@ func markSyncOrphan(tx *gorm.DB, email string, nowMs int64) error {
 func clearSyncOrphanMarks(tx *gorm.DB) error {
 	return tx.Model(&model.ClientRecord{}).
 		Where("sync_orphaned_at > 0 AND EXISTS (SELECT 1 FROM client_inbounds WHERE client_inbounds.client_id = clients.id)").
-		Update("sync_orphaned_at", 0).Error
+		Updates(map[string]any{"sync_orphaned_at": 0, "sync_orphaned_by": 0}).Error
 }
 
 // ReapSyncOrphans deletes the clients the node-snapshot sweep marked and no