fix(node): drop a swept inbound's bookkeeping from the node runtime

The node Remote keeps a fingerprint, a remote id and possibly an alias
per inbound tag. When the master swept an inbound the node stopped
reporting, those entries stayed, so a node rotating tags grew the maps
for as long as the master ran. The sweep now hands every removed tag to
Remote.ForgetInbound, which drops all of it in both tag forms, and a
master-driven delete uses it too. The sweep's call is wiring;
TestRemoteForgetInboundDropsEveryTrace covers what it drops.

internal/web/runtime/remote.go

@@ -498,7 +498,7 @@ func (r *Remote) DelInbound(ctx context.Context, ib *model.Inbound) error {
 	if _, err := r.do(ctx, http.MethodPost, "panel/api/inbounds/del/"+strconv.Itoa(id), nil); err != nil {
 		return err
 	}
-	r.cacheDel(ib.Tag)
+	r.ForgetInbound(ib.Tag)
 	return nil
 }
 
@@ -581,6 +581,23 @@ func (r *Remote) ForgetPushedInbound(tag string) {
 	r.mu.Unlock()
 }
 
+// ForgetInbound drops everything kept under an inbound the node no longer has, in either
+// tag form: a node rotating tags would otherwise grow these maps without bound.
+func (r *Remote) ForgetInbound(tag string) {
+	prefix := nodeInboundTagPrefix(r.node.Id)
+	bare := strings.TrimPrefix(tag, prefix)
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	for _, t := range []string{bare, prefix + bare} {
+		if alias, ok := r.adoptedAliases[t]; ok {
+			delete(r.remoteIDByTag, alias)
+			delete(r.adoptedAliases, t)
+		}
+		delete(r.remoteIDByTag, t)
+		delete(r.pushedFP, t)
+	}
+}
+
 // AdoptInboundAlias records a deployed alias without mutating either panel.
 // The runtime association is rediscovered after a master restart.
 func (r *Remote) AdoptInboundAlias(ib *model.Inbound, remote RemoteInboundOption) {

internal/web/runtime/remote_test.go

@@ -538,3 +538,19 @@ func TestRemoteNodeListsAreCappedByEntryCount(t *testing.T) {
 		t.Fatalf("GetDescendants = %d entries, %v; want errRemoteListTooLong", len(got), err)
 	}
 }
+
+// A node rotating inbound tags must not grow the per-tag maps forever: an inbound the
+// master swept leaves nothing behind in either tag form, its adopted alias included.
+func TestRemoteForgetInboundDropsEveryTrace(t *testing.T) {
+	n := &model.Node{Id: 7, Name: "n"}
+	r := NewRemote(n, nil)
+	ib := &model.Inbound{Tag: "n7-in-443", Port: 443, Protocol: model.VLESS}
+	r.AdoptInboundAlias(ib, RemoteInboundOption{Id: 3, Tag: "in-443"})
+	r.RecordAdoptedInbound(&model.Inbound{Tag: "in-443", Port: 443, Protocol: model.VLESS})
+	r.ForgetInbound("in-443")
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+	if len(r.pushedFP)+len(r.remoteIDByTag)+len(r.adoptedAliases) != 0 {
+		t.Fatalf("left behind: pushedFP=%v ids=%v aliases=%v", r.pushedFP, r.remoteIDByTag, r.adoptedAliases)
+	}
+}