feat(migrations): Add WARP auto-integration with redsocks and iptables

- Implemented migration 067 to set up Cloudflare WARP with automatic routing for VPN client TCP traffic through a redsocks proxy.
- Included installation scripts for WARP and redsocks, along with iptables rules for traffic redirection.
- Added detection for X-Ray and patching of its outbound configuration.
- Created uninstall scripts to clean up configurations and remove installed packages.

fix(migrations): Enhance WARP install script for heredoc compatibility

- Implemented migration 068 to fix nested heredoc conflicts and streamline the WARP installation script for panel compatibility.
- Removed duplicate `set -eo pipefail` and adjusted formatting for better readability.

feat(migrations): Auto-detect AIVPN subnet for routing in WARP setup

- Implemented migration 069 to enhance the WARP installation script by adding detection for AIVPN subnets alongside existing AWG container detection.
- Updated routing logic to handle both container IPs and host-level VPN subnets.
- Ensured proper configuration of iptables for seamless traffic routing through the WARP proxy.

README.md

@@ -31,6 +31,7 @@ Web-based management panel for Amnezia AWG (WireGuard) VPN servers.
 - MTProxy (Telegram) (`mtproxy`)
 - SMB Server (`smb`)
 - AIVPN (`aivpn`) - https://github.com/infosave2007/aivpn
+- Cloudflare WARP Proxy (`cf-warp`) — transparent traffic proxying via Cloudflare
 
 
 ## Requirements
@@ -205,6 +206,19 @@ Manage VPN protocols via **Settings → Protocols**:
 - Configure protocol settings (ports, transport, obfuscation)
 - **AI Assistant**: Use "Ask AI" to generate complex protocol configurations tailored to your needs (requires OpenRouter API key).
 
+### Cloudflare WARP Proxy
+
+WARP transparently proxies **all TCP traffic** from VPN clients through the Cloudflare network, hiding the server's real IP address.
+
+> **⚠️ Install WARP last** — after all other protocols (AWG, X-Ray, AIVPN, etc.). During installation, WARP automatically detects active VPN containers and interfaces and configures routing for each of them.
+
+**Supported protocols:**
+- **AWG / AWG2** — routing via container IP + host redsocks
+- **X-Ray VLESS** — `warp-out` outbound via SOCKS5 in X-Ray config
+- **AIVPN / WireGuard** — routing via host-level iptables + redsocks
+
+**Verification:** connect to VPN and open `https://1.1.1.1/cdn-cgi/trace` — the field `warp=on` confirms it's working.
+
 ### Scenario Testing & Logs
 
 **Scenario Testing**: