probe-only node mode: master flag + agent gate + panel switch (V2.1.0 A)

agent_nodes gains probe_only; getConfig always serves the flag and withholds the sing-box payload (null config, empty hash) for flagged nodes while probe tasks, fast interval, stat iface and update intents ride as usual. The agent gates both core branches when the local agent.json preset or the master flag is on, retires a running core once (best-effort tail flush, switchover bookkeeping untouched so turning the flag off self-heals through the existing hash-current-but-not-running path), and makes the traffic cycle an explicit no-op. Panel: node create/update accept probeOnly, the node view overlays it from the binding, the node form gains a switch (carried into the generated install command), the list shows a probe-only tag in the core-version cell, and install-agent.sh --probe-only writes the preset, skips the core download/self-check and inherits the flag on no-arg reruns.

internal/web/controller/node.go

@@ -8,6 +8,9 @@ import (
 	"strconv"
 	"time"
 
+	"github.com/mhsanaei/3x-ui/v3/internal/database"
+	"github.com/mhsanaei/3x-ui/v3/internal/database/model"
+	"github.com/mhsanaei/3x-ui/v3/internal/logger"
 	"github.com/mhsanaei/3x-ui/v3/internal/web/middleware"
 	"github.com/mhsanaei/3x-ui/v3/internal/web/service"
 
@@ -167,11 +170,25 @@ func (a *NodeController) add(c *gin.Context) {
 	if isAgent {
 		view.NodeType = "agent"
 		nodeID := view.Id
-		token, _, err := issueAgentToken(&nodeID, n.Name)
+		token, agentID, err := issueAgentToken(&nodeID, n.Name)
 		if err != nil {
 			jsonMsg(c, I18nWeb(c, "pages.nodes.toasts.add"), err)
 			return
 		}
+		// Probe-only (V2.1.0): preset the flag on the freshly issued
+		// agent row when the create form asked for it, so the very
+		// first config poll already serves no core payload. A failed
+		// preset only logs — the node and token are usable, and the
+		// flag can still be flipped from the edit form.
+		if n.ProbeOnly != nil && *n.ProbeOnly {
+			if err := database.GetDB().Model(&model.AgentNode{}).
+				Where("id = ?", agentID).
+				Update("probe_only", true).Error; err != nil {
+				logger.Warningf("node add: preset probe_only for agent %d failed: %v", agentID, err)
+			} else {
+				view.ProbeOnly = true
+			}
+		}
 		jsonMsgObj(c, I18nWeb(c, "pages.nodes.toasts.add"), gin.H{
 			"node":       view,
 			"agentToken": token,