fix(auth): add node-admin token scope for panel updates (#6666)

* feat(auth): add node-admin API token scope

Keep ordinary node-sync credentials unable to self-update a remote panel while allowing explicitly elevated node administrators to inherit synchronization access and invoke updatePanel.

* style(docs): format API scope table

* fix(auth): preserve mTLS node-sync semantics

Allow only an explicit node-admin bearer to elevate a verified mTLS request. Existing admin, monitor, and node-sync bearer values continue to use the historical node-sync identity on mTLS connections.

* chore(ci): rerun flaky checks

---------

Co-authored-by: libmur-dev <333915961+libmur-dev@users.noreply.github.com>

internal/web/translation/zh-CN.json

@@ -1425,6 +1425,15 @@
         "apiTokenName": "名称",
         "apiTokenNamePlaceholder": "例如 central-panel-a",
         "apiTokenNameRequired": "名称必填",
+        "apiTokenScope": "权限范围",
+        "apiTokenScopeAdmin": "管理员",
+        "apiTokenScopeAdminDesc": "可访问面板的所有 API 端点。仅用于可信的自动化。",
+        "apiTokenScopeMonitor": "监控",
+        "apiTokenScopeMonitorDesc": "只读访问系统状态、版本和指标。",
+        "apiTokenScopeNodeSync": "节点同步",
+        "apiTokenScopeNodeSyncDesc": "同步节点配置、入站、客户端、流量和 Xray 状态。不能更新面板软件。",
+        "apiTokenScopeNodeAdmin": "节点管理员",
+        "apiTokenScopeNodeAdminDesc": "包含节点同步权限，还可以启动面板软件更新。",
         "apiTokenEmpty": "暂无令牌 — 创建一个用于认证机器人或远程面板。",
         "apiTokenDeleteWarning": "使用此令牌的任何调用方将立即无法认证。",
         "apiTokenCreatedTitle": "令牌已创建",