feat(clients): bind host rules to individual clients in subscriptions (#6620)

Host rules applied per inbound only, so every client of an inbound got the same
subscription endpoints (#6618). A client can now be bound to one or more host
rules, and its raw, JSON and Clash subscriptions render only those hosts, in
either subscription order; an unbound client is unchanged. A binding whose hosts
are deleted, disabled or excluded from the format fails closed: the client gets
no links there but stays in traffic accounting. Host edits keep row ids, so
bindings survive them; nil leaves a stored binding alone and an empty list
clears it.

internal/web/service/client_renewal_write_validation_test.go

@@ -1,6 +1,7 @@
 package service
 
 import (
+	"reflect"
 	"testing"
 	"time"
 
@@ -76,7 +77,8 @@ func TestClientRenewalWriteValidation(t *testing.T) {
 					t.Fatal("rejected write changed inbound settings")
 				}
 				record, err = svc.GetRecordByEmail(nil, beforeRecord.Email)
-				if err != nil || *record != beforeRecord || readTraffic(t, database.GetDB(), beforeRecord.Email) != beforeTraffic {
+				// ClientRecord holds slices, so it is not comparable with !=.
+				if err != nil || !reflect.DeepEqual(*record, beforeRecord) || readTraffic(t, database.GetDB(), beforeRecord.Email) != beforeTraffic {
 					t.Fatalf("rejected write changed client/traffic: record=%+v error=%v", record, err)
 				}
 				for _, table := range []string{"inbounds", "clients", "client_traffics"} {