feat(xray): add the MASQUE protocol and transport

xray-core v26.10.10 serves MASQUE: CONNECT-IP over HTTP/3 or HTTP/2,
always behind TLS, as an inbound and an outbound protocol riding a
dedicated "masque" transport. The panel could not create either.

Inbound: MASQUE is a multi-user protocol whose users log in with their
email and password over Basic auth. The panel keeps the client's
"password" like trojan and GenXrayInboundConfig hands it to the core as
"pass", so the full-config path, the live AddInbound path and node
pushes all emit what the core reads; one user with an empty pass makes
the core refuse the whole inbound. Live user adds build a masque.Account
from either key, client-only changes diff per user so a new client does
not drop every connected tunnel, and client creation, copy, validation
and edits key on the password. The address pool and MTU get form
fields, TLS is mandatory, and the port check follows the core's
listener choice: HTTP/2 on TCP when the ALPN offers h2, HTTP/3 on UDP
when it offers h3 or not h2. Nodes may host MASQUE from v3.9.1, the
first panel release that knows to rename the password.

MASQUE has no share-link format, so links and Clash skip it; the JSON
subscription builds the client's masque outbound with its email and
password, and the subscription allowlist now lets a subId see MASQUE
inbounds at all. The IP-limit job, client pages and traffic tracking
list the protocol.

Outbound: the form edits the server, remote DNS, and the transport's
host, path, Basic credentials, headers and WARP block (enrolled key,
endpoint public key, tunnel addresses), which xray-core refuses next to
user/pass. The outbound test probes it through the core, since its
default HTTP/3 dial is UDP.

docs/content/docs/en/config/masque.mdx

@@ -0,0 +1,54 @@
+---
+title: MASQUE
+description: Serve MASQUE (CONNECT-IP) inbounds in 3x-ui, connect outbounds to MASQUE servers, and reach Cloudflare WARP over MASQUE.
+icon: Waypoints
+---
+
+**MASQUE** carries IP packets over HTTP/3 (or HTTP/2) with the CONNECT-IP method, so a
+client gets a full layer-3 tunnel that looks like ordinary HTTPS traffic. xray-core
+serves it natively; 3x-ui offers it as an inbound protocol, an outbound protocol, and the
+matching `masque` transport they both ride on.
+
+## Inbound
+
+| Field            | Description |
+| ---------------- | ----------- |
+| **Clients**      | Each client logs in with its **email** and **password** (HTTP Basic auth). Traffic, quotas, IP limits and expiry work like any other multi-user protocol. |
+| **Address pool** | Prefixes the tunnel addresses are leased from — at most one IPv4 and one IPv6 (default `10.14.0.1/24`, `fd14::1/64`). The pool size caps how many clients can be connected at once. |
+| **MTU**          | Tunnel MTU, 1280–65535; leave empty for the core default. |
+| **Path**         | Request path the server answers on (default `/.well-known/masque/ip/*/*/`). |
+| **Security**     | Always TLS. The ALPN picks the listeners: `h3` serves HTTP/3 on UDP, `h2` serves HTTP/2 on TCP, and both together serve both. |
+
+<Callout type="info">
+  MASQUE has no share-link format, so MASQUE inbounds get no link, QR code or Clash
+  entry. Clients get a ready-to-import config from the **JSON subscription**: a `masque`
+  outbound that authenticates with the client's email and password.
+</Callout>
+
+## Outbound
+
+Pick **masque** as the outbound protocol, then set:
+
+| Field                   | Description |
+| ----------------------- | ----------- |
+| **Address / Port**      | The MASQUE server. |
+| **Remote DNS**          | Optional DNS server IPs queried inside the tunnel. |
+| **Host / Path**         | Authority and path of the CONNECT-IP request; the path must match the server's. |
+| **Username / Password** | HTTP Basic credentials — on a 3x-ui server, the client's email and password. |
+| **Headers**             | Extra request headers. |
+| **TLS**                 | Required. An ALPN of `h2` alone switches to HTTP/2 over TCP; otherwise HTTP/3 is used. |
+
+## WARP over MASQUE
+
+Turn on **WARP** in the masque transport to reach Cloudflare WARP through its MASQUE
+endpoint instead of WireGuard. It takes a WARP registration enrolled for MASQUE:
+
+| Field                   | Description |
+| ----------------------- | ----------- |
+| **Private key**         | The enrolled ECDSA P-256 private key (PEM, or base64 DER). |
+| **Endpoint public key** | Cloudflare's endpoint public key returned by the enrollment. |
+| **Tunnel addresses**    | The IPv4 and IPv6 addresses Cloudflare assigned to the registration. |
+
+Host and path then default to Cloudflare's endpoint, and WARP can't be combined with a
+username or password. Point the outbound at the endpoint address from your enrollment and
+set the TLS server name to `consumer-masque.cloudflareclient.com`.