3x-ui agent: 轻量节点 agent 化

- Agent 通过 token 向主控注册，心跳/拉取 xray 配置/上报流量
- 主控按节点下发完整 xray 配置（含出站+路由），agent 只应用不自建
- Agent 心跳同步更新节点在线状态；后台探针跳过 agent 托管节点
- 「添加节点」支持 Agent 类型，自动生成 token 并弹窗展示
- VLESS/SS2022 入站；同机测试支持 api_port 隔离
- 新增 install-master.sh / install-agent.sh 一键安装脚本
- systemd + OpenWrt procd 服务文件，docs/AGENT.md

internal/web/controller/api.go

@@ -19,6 +19,7 @@ type APIController struct {
 	inboundController     *InboundController
 	serverController      *ServerController
 	nodeController        *NodeController
+	agentController       *AgentController
 	hostController        *HostController
 	settingController     *SettingController
 	xraySettingController *XraySettingController
@@ -191,6 +192,21 @@ func (a *APIController) initRouter(g *gin.RouterGroup) {
 	nodes := api.Group("/nodes")
 	a.nodeController = NewNodeController(nodes)
 
+	// Agent API — lightweight agent mode (no web panel on node).
+	// The agent endpoints (register/heartbeat/config/traffic) authenticate with
+	// the agent's own Bearer token, which is NOT a panel API token, so they are
+	// mounted on a public group and must not pass through checkAPIAuth (it would
+	// 404 every agent call: no session, no panel token).
+	agentPub := g.Group("/panel/api/agent")
+	a.agentController = NewAgentController(agentPub)
+
+	// Agent administration — panel-authenticated (session login or panel API
+	// token via the group's checkAPIAuth): token issuance and per-agent egress
+	// management. Agent Bearer tokens cannot pass checkAPIAuth, so agents can
+	// never reach these.
+	agentAdmin := api.Group("/agent")
+	a.agentController.RegisterAdminRoutes(agentAdmin)
+
 	// Hosts API — per-inbound override endpoints for subscription links
 	hosts := api.Group("/hosts")
 	a.hostController = NewHostController(hosts)