feat: XRay Reality key backup and restoration

- Modified migrations/048_enable_xray_stats.sql to accept existing keys via env vars (PRIVATE_KEY, SHORT_ID)
- Updated InstallProtocolManager.php to extract and store reality_private_key after XRay installation
- Added key restoration logic in buildExports() to reuse saved keys during reinstallation
- Fixed VpnClient.php to correctly parse JSON stats output from XRay API
- Security fix: removed exposed port 2375 from docker-compose.yml (dind container)

migrations/012_add_user_roles.sql

@@ -1,32 +0,0 @@
--- Migration: Add user roles and permissions
--- Date: 2025-11-10
-
--- User roles table
-CREATE TABLE IF NOT EXISTS user_roles (
-    id INT PRIMARY KEY AUTO_INCREMENT,
-    name VARCHAR(50) NOT NULL UNIQUE,
-    display_name VARCHAR(100) NOT NULL,
-    description TEXT,
-    permissions JSON NOT NULL,
-    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
-) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
-
--- Add role to users table
-ALTER TABLE users 
-ADD COLUMN role VARCHAR(50) DEFAULT 'viewer' AFTER ldap_dn,
-ADD INDEX idx_role (role);
-
--- Insert default roles
-INSERT IGNORE INTO user_roles (name, display_name, description, permissions) VALUES
-('admin', 'Administrator', 'Full access to all features', JSON_ARRAY('*')),
-('manager', 'Manager', 'Can manage servers and clients', JSON_ARRAY('servers.view', 'servers.create', 'servers.edit', 'clients.view', 'clients.create', 'clients.edit', 'clients.delete')),
-('viewer', 'Viewer', 'Can only view own clients', JSON_ARRAY('clients.view_own', 'clients.download_own'));
-
--- Insert default LDAP group mappings (examples)
-INSERT IGNORE INTO ldap_group_mappings (ldap_group, role_name, description) VALUES
-('vpn-admins', 'admin', 'VPN administrators with full access'),
-('vpn-managers', 'manager', 'VPN managers who can create and manage clients'),
-('vpn-users', 'viewer', 'Regular VPN users with view-only access');
-
--- Update existing users to admin role (backward compatibility)
-UPDATE users SET role = 'admin' WHERE role IS NULL OR role = '';