feat: add configurable IP egress strategy

[boltguo]

What changed

• add automatic, prefer IPv4, prefer IPv6, IPv4-only, and IPv6-only egress strategies
• generate the current sing-box domain_resolver configuration with a local DNS server
• apply and restart sing-box only when the egress strategy changes
• expose the setting in the bilingual panel and rebuild the embedded frontend
• document IPv4/IPv6 ingress and egress behavior

Why

Some VPS IPv4 ranges retain stale geolocation even after moving to a US ASN, while the server IPv6 range is correctly identified. Preferring IPv6 lets dual-stack destinations see the accurate IPv6 location while preserving IPv4 fallback.

Safety and compatibility

• legacy configs without the field are normalized to auto
• unknown strategies are rejected
• a failed sing-box configuration check rolls the business setting back
• requires sing-box 1.12 or newer when a non-default strategy is selected

Validation

• frontend typecheck and production build
• ShellCheck and installer unit tests
• go test ./... and go test -race ./...
• go vet ./... and gofmt check
• Linux amd64/arm64 cross-build
• release smoke test
• real sing-box 1.13.14 check for the generated prefer_ipv6 configuration

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f355fe71a3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Serialize the strategy comparison with the settings mutation

When two PUT /api/settings requests overlap, this comparison occurs before either mutate or saveConfig acquires mutationMu. For example, a request restoring auto can read the old auto value while another request is applying prefer_ipv6, then enter saveConfig after that apply and overwrite the business config without reapplying the core configuration. The stored setting and running/generated sing-box configuration then disagree until a later core apply, so select the apply path while holding the same mutation lock.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Enforce a newly lowered quota before restarting the core

When one settings request both changes the outbound strategy and lowers totalBytes below the already-recorded usage, routing it through mutate calls Core.Apply using the old QuotaExceeded state. The core is therefore restarted and may serve traffic before the later ReconcileQuota call notices the new limit and stops it; a quota-only update does not have this window. Compute/reconcile the quota against the new settings before allowing this strategy apply to restart sing-box.

Useful? React with 👍 / 👎.