fix(auth): add node-admin token scope for panel updates (#6666)

* feat(auth): add node-admin API token scope

Keep ordinary node-sync credentials unable to self-update a remote panel while allowing explicitly elevated node administrators to inherit synchronization access and invoke updatePanel.

* style(docs): format API scope table

* fix(auth): preserve mTLS node-sync semantics

Allow only an explicit node-admin bearer to elevate a verified mTLS request. Existing admin, monitor, and node-sync bearer values continue to use the historical node-sync identity on mTLS connections.

* chore(ci): rerun flaky checks

---------

Co-authored-by: libmur-dev <333915961+libmur-dev@users.noreply.github.com>

internal/web/translation/zh-TW.json

@@ -1425,6 +1425,15 @@
         "apiTokenName": "名稱",
         "apiTokenNamePlaceholder": "例如 central-panel-a",
         "apiTokenNameRequired": "名稱必填",
+        "apiTokenScope": "權限範圍",
+        "apiTokenScopeAdmin": "管理員",
+        "apiTokenScopeAdminDesc": "可存取面板的所有 API 端點。僅用於可信的自動化。",
+        "apiTokenScopeMonitor": "監控",
+        "apiTokenScopeMonitorDesc": "唯讀存取系統狀態、版本和指標。",
+        "apiTokenScopeNodeSync": "節點同步",
+        "apiTokenScopeNodeSyncDesc": "同步節點設定、入站、用戶端、流量和 Xray 狀態。無法更新面板軟體。",
+        "apiTokenScopeNodeAdmin": "節點管理員",
+        "apiTokenScopeNodeAdminDesc": "包含節點同步權限，也可以啟動面板軟體更新。",
         "apiTokenEmpty": "尚無令牌 — 建立一個以認證機器人或遠端面板。",
         "apiTokenDeleteWarning": "使用此令牌的任何呼叫方將立即無法認證。",
         "apiTokenCreatedTitle": "權杖已建立",