fix(auth): add node-admin token scope for panel updates (#6666)

* feat(auth): add node-admin API token scope

Keep ordinary node-sync credentials unable to self-update a remote panel while allowing explicitly elevated node administrators to inherit synchronization access and invoke updatePanel.

* style(docs): format API scope table

* fix(auth): preserve mTLS node-sync semantics

Allow only an explicit node-admin bearer to elevate a verified mTLS request. Existing admin, monitor, and node-sync bearer values continue to use the historical node-sync identity on mTLS connections.

* chore(ci): rerun flaky checks

---------

Co-authored-by: libmur-dev <333915961+libmur-dev@users.noreply.github.com>

internal/web/translation/en-US.json

@@ -1547,6 +1547,15 @@
         "apiTokenName": "Name",
         "apiTokenNamePlaceholder": "e.g. central-panel-a",
         "apiTokenNameRequired": "Name is required",
+        "apiTokenScope": "Scope",
+        "apiTokenScopeAdmin": "Administrator",
+        "apiTokenScopeAdminDesc": "Full access to every panel API endpoint. Use only for trusted automation.",
+        "apiTokenScopeMonitor": "Monitoring",
+        "apiTokenScopeMonitorDesc": "Read-only access to system status, versions, and metrics.",
+        "apiTokenScopeNodeSync": "Node synchronization",
+        "apiTokenScopeNodeSyncDesc": "Synchronizes node configuration, inbounds, clients, traffic, and Xray state. Cannot update panel software.",
+        "apiTokenScopeNodeAdmin": "Node administrator",
+        "apiTokenScopeNodeAdminDesc": "Includes node synchronization permissions and can also start panel software updates.",
         "apiTokenEmpty": "No tokens yet — create one to authenticate bots or remote panels.",
         "apiTokenDeleteWarning": "Any caller using this token will stop authenticating immediately.",
         "apiTokenCreatedTitle": "Token created",