refactor(amneziawg): route via Xray through the stock Routing page, not custom toggles

Simplifies RouteViaXray after realizing the panel already has everything
needed: the Routing page already lets an admin pick a source inbound tag
and a target outbound (plus, if they want it, a specific source IP) for
any protocol. Bolting a parallel routeThroughXray/routeOutboundTag pair
onto both the client and inbound forms duplicated that mechanism instead
of using it.

Removed entirely: Client/ClientRecord/ServerSettings/Peer's
RouteThroughXray + RouteOutboundTag fields, the effective-routing OR/
fallback logic in InstanceFromInbound, and the Switch+Select UI on both
forms. Nothing configures "route via Xray" as a setting anymore.

In its place, every enabled AmneziaWG inbound now gets its own Xray
TPROXY bridge unconditionally, by default, no toggle:

- internal/amneziawg: every peer's traffic is always TPROXY'd into that
  instance's own bridge (defaultPostUpDown, port derived from the
  inbound's id via EgressPortForInbound so the kernel side and the
  Xray-config side never need to negotiate a runtime value). Since the
  TPROXY rule is now tied to a peer's mere presence rather than an
  opt-in flag, hostRulesFingerprint now covers every peer unconditionally
  (add/remove/re-IP forces a restart, the same way ForwardedPorts always
  did) instead of skipping peers with nothing to opt into.
- internal/web/service/xray.go's injectAmneziawgEgress creates one
  dokodemo-door bridge per qualifying inbound, tagged with that inbound's
  own real tag — the same trick injectMtprotoEgress already uses (reusing
  a real inbound's tag), which is why it's already selectable in the
  panel's Routing page: InboundService.GetInboundTags() is a plain,
  protocol-blind SELECT over every inbound row's tag, no dedicated UI
  plumbing needed. The function never generates a routing rule itself
  anymore — where (if anywhere) that traffic goes is entirely up to
  whatever rules the admin adds through the existing Routing UI.

Frontend: no new UI at all. Tests rewritten to match — one bridge per
inbound with its own tag/port, no rule generation, no opt-in gating.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

frontend/src/schemas/client.ts

@@ -38,8 +38,6 @@ export const ClientRecordSchema = z.object({
   preSharedKey: z.string().optional(),
   keepAlive: z.number().optional(),
   forwardedPorts: z.string().optional(),
-  routeThroughXray: z.boolean().optional(),
-  routeOutboundTag: z.string().optional(),
   secret: z.string().optional(),
   adTag: z.string().optional(),
   createdAt: z.number().optional(),

frontend/src/schemas/protocols/inbound/amneziawg.ts

@@ -10,12 +10,9 @@ const optionalClearedInt = (schema: z.ZodNumber) =>
 // WireguardClientSchema — the panel's generic ClientRecord already has those
 // exact keys (privateKey/publicKey/preSharedKey/allowedIPs/keepAlive), so
 // bulk operations, the QR modal and subscriptions all work unmodified — plus
-// two AmneziaWG-only additions: forwardedPorts (WireGuard's Xray-native
-// inbound has no host-level iptables layer to hang per-client DNAT off of)
-// and routeThroughXray/routeOutboundTag (TPROXYs this peer's traffic into a
-// shared Xray bridge instead of NAT'ing it straight out — see
-// internal/amneziawg's EgressPort). Keys are optional on the wire — the
-// backend generates them when absent.
+// one AmneziaWG-only addition, forwardedPorts (WireGuard's Xray-native
+// inbound has no host-level iptables layer to hang per-client DNAT off of).
+// Keys are optional on the wire — the backend generates them when absent.
 export const AmneziawgClientSchema = z.object({
   privateKey: z.string().optional(),
   publicKey: z.string().optional(),
@@ -23,8 +20,6 @@ export const AmneziawgClientSchema = z.object({
   allowedIPs: z.array(z.string()).default([]),
   keepAlive: optionalClearedInt(z.number().int().min(0)),
   forwardedPorts: z.string().default(''),
-  routeThroughXray: z.boolean().default(false),
-  routeOutboundTag: z.string().default(''),
   email: z.string().min(1),
   limitIp: z.number().int().min(0).default(0),
   totalGB: z.number().int().min(0).default(0),
@@ -57,8 +52,6 @@ export const AmneziawgServerSchema = z.object({
   ipv6Enabled: z.boolean().default(false),
   ipv6Subnet: z.string().default(''),
   ipv6ExternalInterface: z.string().default(''),
-  routeThroughXray: z.boolean().default(false),
-  routeOutboundTag: z.string().default(''),
   jc: z.number().int().min(0).default(5),
   jmin: z.number().int().min(0).default(10),
   jmax: z.number().int().min(0).default(50),