fix(web): install the share-link provider before the panel serves (#6914)

The panel started answering requests before the share-link generator was
registered, so an "all links", client sub-links or Telegram link request that
arrived during start-up got "sub link provider not registered". NewServer now
takes the provider and installs it before anything listens, and the provider
registry is guarded by a lock, since start-up writes it while requests read it.

internal/web/web_shutdown_test.go

@@ -10,7 +10,7 @@ import (
 
 func TestServerStopWhenXrayNotRunningSucceeds(t *testing.T) {
 	t.Setenv("XUI_DB_FOLDER", t.TempDir())
-	s := NewServer()
+	s := NewServer(nil)
 	if err := s.Stop(); err != nil {
 		t.Fatalf("expected nil error when stopping server with unstarted xray, got: %v", err)
 	}
@@ -18,7 +18,7 @@ func TestServerStopWhenXrayNotRunningSucceeds(t *testing.T) {
 
 func TestServerStopPanelOnlyWithPreclosedListenerSucceeds(t *testing.T) {
 	t.Setenv("XUI_DB_FOLDER", t.TempDir())
-	s := NewServer()
+	s := NewServer(nil)
 	ln, err := net.Listen("tcp", "127.0.0.1:0")
 	if err != nil {
 		t.Fatalf("net.Listen failed: %v", err)