fix(hwid): track devices only for subscriptions a client owns

The subscription routes run the HWID gate before they look up the
subId, and the gate read "no device limit" and "no such subscription"
alike, so a request naming any path segment with an X-HWID header was
answered 404 yet stored that segment, up to about 1 MiB, in
client_hwids for good. Anyone reaching the subscription port could fill
the disk until the panel could no longer save anything.

An unlimited subscription is tracked only while an enabled client owns
its subId, and a one-time seeder drops the rows already stored for
subIds no client owns.

internal/sub/hwid_controller_test.go

@@ -218,6 +218,27 @@ func TestSubscriptionHwidStatusDoesNotRegisterDevice(t *testing.T) {
 	}
 }
 
+// A 404 for a subId nobody was issued must not persist anything: the gate runs
+// before the lookup, and an attacker can send any number of distinct subIds.
+func TestSubscriptionHwidGateIgnoresUnknownSubID(t *testing.T) {
+	router, _ := initHwidSubRouter(t, 0)
+
+	for _, path := range []string{"/sub/never-issued", "/json/never-issued", "/clash/never-issued"} {
+		rec := requestSub(t, router, http.MethodGet, path, "device-ghost", "")
+		if rec.Code != http.StatusNotFound {
+			t.Fatalf("%s unknown subId status = %d, want 404", path, rec.Code)
+		}
+	}
+
+	var count int64
+	if err := database.GetDB().Model(&model.ClientHwid{}).Where("sub_id = ?", "never-issued").Count(&count).Error; err != nil {
+		t.Fatalf("count hwids: %v", err)
+	}
+	if count != 0 {
+		t.Fatalf("client_hwids rows for an unknown subId = %d, want 0", count)
+	}
+}
+
 func TestSubscriptionHwidStatusWithoutLimit(t *testing.T) {
 	router, subID := initHwidSubRouter(t, 0)