fix(shadowsocks): keep a 2022 inbound with no enabled client locked

When every client of a Shadowsocks-2022 inbound was disabled the panel
handed the core an empty client list, from which xray-core builds a
single-user server keyed by the inbound's server key alone. That key is
the first half of every link the panel ever issued, so a client cut off
for quota, expiry or by the operator connected again with it.

An inbound left without clients now gets a placeholder user whose key
is random and held only in memory, in the config and in the running
core alike. The core stays multi-user, and disabling the last real
client takes the same remove-and-restart path as any other client, so
its live sessions end as well.

internal/web/service/inbound.go

@@ -2508,6 +2508,9 @@ func (s *InboundService) stripDisabledClients(tx *gorm.DB, inbound *model.Inboun
 		finalClients = append(finalClients, c)
 	}
 	settings["clients"] = finalClients
+	if inbound.Protocol == model.Shadowsocks {
+		xray.LockShadowsocks2022(settings)
+	}
 
 	modifiedSettings, err := json.MarshalIndent(settings, "", "  ")
 	if err != nil {