fix(inbounds): refuse 2022-blake3-chacha20-poly1305 on shadowsocks inbounds

xray-core builds a Shadowsocks-2022 inbound with users only for the AES
methods: the multi-user identity header is AES-only, so the config
builder and the multi-user server both reject chacha20. Every panel
inbound carries clients, so picking 2022-blake3-chacha20-poly1305 in the
inbound form kept the whole core from starting; its links also failed
on the client with "multi-key is not supported".

The inbound form no longer offers the method and AddInbound/UpdateInbound
reject it. Startup moves stored inbounds to 2022-blake3-aes-256-gcm,
which takes the same 32-byte keys, so every stored key stays valid.
Outbounds keep the method, since a single-key outbound to such a server
works. The share-link generator drops the single-user branch that only
this method reached.

frontend/src/test/inbound-from-db.test.ts

@@ -266,16 +266,6 @@ describe('getInboundClients with schema-shaped inbound', () => {
     expect(getInboundClients(inbound)).toHaveLength(1);
   });
 
-  it('returns null for SS single-user', () => {
-    const inbound = inboundFromDb({
-      ...BASE_DB_FIELDS,
-      protocol: 'shadowsocks',
-      settings: { method: '2022-blake3-chacha20-poly1305', password: 'pw', clients: [] },
-      streamSettings: { network: 'tcp', security: 'none' },
-    });
-    expect(getInboundClients(inbound)).toBeNull();
-  });
-
   it('returns null for non-client protocols (http/mixed/tun/tunnel)', () => {
     for (const protocol of ['http', 'mixed', 'tun', 'tunnel']) {
       const inbound = inboundFromDb({

frontend/src/test/shadowsocks-inbound-method.test.ts

@@ -0,0 +1,29 @@
+import { describe, expect, it } from 'vitest';
+
+import { ShadowsocksInboundSettingsSchema } from '@/schemas/protocols/inbound/shadowsocks';
+import { SSMethodSchema } from '@/schemas/protocols/shared/shadowsocks';
+
+// xray-core refuses 2022-blake3-chacha20-poly1305 on an inbound with users (the
+// multi-user identity header is AES-only), and every panel inbound carries users.
+describe('shadowsocks inbound method', () => {
+  it('rejects 2022-blake3-chacha20-poly1305 on an inbound', () => {
+    const parsed = ShadowsocksInboundSettingsSchema.safeParse({
+      method: '2022-blake3-chacha20-poly1305',
+    });
+    expect(parsed.success).toBe(false);
+    expect(parsed.error?.issues[0].path).toEqual(['method']);
+  });
+
+  it('still accepts the AES 2022 and the legacy chacha methods', () => {
+    for (const method of ['2022-blake3-aes-256-gcm', 'chacha20-ietf-poly1305']) {
+      expect(ShadowsocksInboundSettingsSchema.parse({ method }).method).toBe(method);
+    }
+  });
+
+  // A single-key outbound to a 2022-chacha20 server works, so only inbounds lose it.
+  it('keeps 2022-blake3-chacha20-poly1305 for outbounds', () => {
+    expect(SSMethodSchema.parse('2022-blake3-chacha20-poly1305')).toBe(
+      '2022-blake3-chacha20-poly1305',
+    );
+  });
+});