V2.0.1: listen override fix, sing-box core fetch, probe settings page + fast report, spx removal, core mem env

- 0: sing-box gen overrides fragment listen/port from the inbound row
  (empty listen -> "::"), Update/Add recompute the stored fragment;
  non-loopback E2E against the real core binary.
- 1: agent fetches the sing-box core from the Gitea release when
  missing, self-checks it, and only then latches the switch.
- 2: node list shows the sing-box core version (heartbeat field,
  persisted on the node row), xray version as fallback.
- 3: public-page fallback returns 404 to anonymous visitors when the
  page is disabled.
- 4: settings restart hint bar removed, dead i18n keys cleaned.
- 5: two PUT calls missing JSON headers fixed (audit: only those two),
  batch probe-task creation endpoint + UI.
- 6: cf-probe retirement card and coverage pipeline removed.
- 7: generated vless links no longer carry spx (panel export + sub);
  parser still accepts spx; golden fixtures updated.
- probe batch: dedicated probe settings tab (public-page settings,
  tasks, per-node meta), retention_days editable, per-node traffic
  calibration + stat-interface pinning, runtime metrics split into a
  lightweight fast report (default 3s, 1-60s adjustable).
- 8: sing-box core processes start with GOMEMLIMIT=32MiB, GOGC=50.
- 9: dead /getTwoFactorEnable docs entries removed (frontend call and
  contract entry already gone at base; verified by grep).

internal/web/service/probe/store.go

@@ -65,7 +65,12 @@ CREATE TABLE IF NOT EXISTS probe_meta (
   notify            INTEGER NOT NULL DEFAULT 0,
   country_pin       TEXT    NOT NULL DEFAULT '',
   ipv4_pin          TEXT    NOT NULL DEFAULT '',
-  ipv6_pin          TEXT    NOT NULL DEFAULT ''
+  ipv6_pin          TEXT    NOT NULL DEFAULT '',
+  -- V2.0.1 probe batch: operator traffic calibration (GB, either
+  -- sign) and the counted-interface pin ('' = automatic selection).
+  traffic_cal_up_gb   REAL NOT NULL DEFAULT 0,
+  traffic_cal_down_gb REAL NOT NULL DEFAULT 0,
+  stat_iface          TEXT NOT NULL DEFAULT ''
 );
 
 -- Monotonic byte counters that survive agent reboots and master
@@ -204,9 +209,55 @@ func Open(path string) (*Store, error) {
 		db.Close()
 		return nil, fmt.Errorf("probe schema: %w", err)
 	}
+	if err := migrateMetaColumns(db); err != nil {
+		db.Close()
+		return nil, fmt.Errorf("probe schema migration: %w", err)
+	}
 	return &Store{db: db, nodes: make(map[int64]*nodeState)}, nil
 }
 
+// metaColumnMigrations are the probe_meta columns added after the
+// table's first release; CREATE TABLE IF NOT EXISTS never retrofits
+// them onto an existing database, so they are added here, once, by
+// name check (SQLite has no ADD COLUMN IF NOT EXISTS).
+var metaColumnMigrations = []struct{ name, ddl string }{
+	{"traffic_cal_up_gb", `ALTER TABLE probe_meta ADD COLUMN traffic_cal_up_gb REAL NOT NULL DEFAULT 0`},
+	{"traffic_cal_down_gb", `ALTER TABLE probe_meta ADD COLUMN traffic_cal_down_gb REAL NOT NULL DEFAULT 0`},
+	{"stat_iface", `ALTER TABLE probe_meta ADD COLUMN stat_iface TEXT NOT NULL DEFAULT ''`},
+}
+
+func migrateMetaColumns(db *sql.DB) error {
+	rows, err := db.Query(`PRAGMA table_info(probe_meta)`)
+	if err != nil {
+		return err
+	}
+	have := map[string]bool{}
+	for rows.Next() {
+		var cid int
+		var name, typ string
+		var notNull int
+		var dflt sql.NullString
+		var pk int
+		if err := rows.Scan(&cid, &name, &typ, &notNull, &dflt, &pk); err != nil {
+			rows.Close()
+			return err
+		}
+		have[name] = true
+	}
+	if err := rows.Close(); err != nil {
+		return err
+	}
+	for _, m := range metaColumnMigrations {
+		if have[m.name] {
+			continue
+		}
+		if _, err := db.Exec(m.ddl); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 // Close releases the database handle.
 func (s *Store) Close() error {
 	if s == nil || s.db == nil {