V2.0.1: listen override fix, sing-box core fetch, probe settings page + fast report, spx removal, core mem env

- 0: sing-box gen overrides fragment listen/port from the inbound row
  (empty listen -> "::"), Update/Add recompute the stored fragment;
  non-loopback E2E against the real core binary.
- 1: agent fetches the sing-box core from the Gitea release when
  missing, self-checks it, and only then latches the switch.
- 2: node list shows the sing-box core version (heartbeat field,
  persisted on the node row), xray version as fallback.
- 3: public-page fallback returns 404 to anonymous visitors when the
  page is disabled.
- 4: settings restart hint bar removed, dead i18n keys cleaned.
- 5: two PUT calls missing JSON headers fixed (audit: only those two),
  batch probe-task creation endpoint + UI.
- 6: cf-probe retirement card and coverage pipeline removed.
- 7: generated vless links no longer carry spx (panel export + sub);
  parser still accepts spx; golden fixtures updated.
- probe batch: dedicated probe settings tab (public-page settings,
  tasks, per-node meta), retention_days editable, per-node traffic
  calibration + stat-interface pinning, runtime metrics split into a
  lightweight fast report (default 3s, 1-60s adjustable).
- 8: sing-box core processes start with GOMEMLIMIT=32MiB, GOGC=50.
- 9: dead /getTwoFactorEnable docs entries removed (frontend call and
  contract entry already gone at base; verified by grep).

internal/web/controller/probe_public.go

@@ -378,5 +378,15 @@ func (pc *PublicProbeController) HandleFallback(c *gin.Context) bool {
 	} else if strings.HasPrefix(path, "/panel") || strings.HasPrefix(path, "/assets") {
 		return false
 	}
+	// V2.0.1 ③: with the public page switched off, the theme shell
+	// is not public content — an anonymous visitor gets a plain 404
+	// (the pre-item-7 behaviour for the root path), never the shell
+	// whose "public page off" redirect chain dead-ends on /admin.
+	// A logged-in operator still reaches the theme (preview, theme
+	// config edits), exactly like the data APIs' own gate.
+	if !service.ProbePublicPageEnabled() && !probeAuthed(c) {
+		answerText(c, http.StatusNotFound, "404 page not found")
+		return true
+	}
 	return service.ServeProbeThemePath(c, strings.TrimPrefix(path, "/"))
 }