fix(node): bound what one node inbound adds to a subscription

A subscription renders an inbound's stream and remark once per client
and per external proxy, and every client holding its subId, all values
a node chooses: an inbound with a megabyte stream and thousands of
external proxies, or many clients sharing one subId, made a single
unauthenticated request cost gigabytes of memory and minutes of CPU.

A reported inbound whose streamSettings exceeds 64 KiB, sniffing 16 KiB
or remark 1 KiB, or that lists more than 64 external proxies, is no
longer taken in (an existing one keeps its stored values), and a node
can no longer give a client a subId another client already holds,
including another one in the same snapshot.

internal/web/service/inbound_node.go

@@ -708,6 +708,7 @@ func (s *InboundService) setRemoteTrafficLocked(nodeID int, snap *runtime.Traffi
 	mergedCentral := make(map[int]struct{}, len(central))
 
 	snapTags := make(map[string]struct{}, len(snap.Inbounds))
+	oversizeTags := map[string]string{}
 	for snapIdx, snapIb := range snap.Inbounds {
 		if snapIb == nil {
 			continue
@@ -759,6 +760,11 @@ func (s *InboundService) setRemoteTrafficLocked(nodeID int, snap *runtime.Traffi
 			}
 			mergedCentral[c.Id] = struct{}{}
 		}
+		if reason := oversizeNodeInbound(snapIb); reason != "" {
+			oversizeTags[snapIb.Tag] = reason
+			snap.Inbounds[snapIdx] = nil
+			continue
+		}
 		if !ok {
 			if dirty {
 				continue
@@ -915,6 +921,7 @@ func (s *InboundService) setRemoteTrafficLocked(nodeID int, snap *runtime.Traffi
 		}
 	}
 
+	logOversizeNodeInbounds(nodeID, oversizeTags)
 	if hostGroupsSkipped > 0 {
 		logger.Warningf(
 			"setRemoteTraffic: node %d: left out %d host group adoption(s) — a group is limited to %d bytes and the node's inbounds to %d host rows",