perf(panel): kill per-request full-database clones (item 22, backend)

Data.Clone() was a full JSON marshal/unmarshal round trip (with a
per-record map dance for unknown fields): 6.3ms and ~13.8k allocs per
call on sandbox hardware, and every admin GET paid it at least twice
(RequireAdmin's user lookup + the handler). Clone is now a reflective
deep copy of the plain data graph — byte-identical output, proven
against the JSON clone on the real seed database by
TestCloneEquivalence — at 0.37ms / 538 allocs. CurrentAdmin resolves
the session user under a read-only store View and no longer clones
at all, so an admin GET takes exactly one snapshot. Sandbox
benchmarks (11 servers / 26 customers / 25 nodes): overview
17.2ms -> 0.38ms, servers 13.3 -> 0.85ms, customers 20.5 -> 1.54ms,
nodes 15.8 -> 3.45ms, jobs 13.0 -> 0.39ms per request.

panel-go/subscriptions.go

@@ -118,9 +118,15 @@ func NodeClientURI(d *Data, nc *NodeClient) string {
 	socksUser := NodeEmail(nc.CustomerID)
 	relayPassword := creds.RelayPassword
 	if node.Protocol == "socks5-auth" {
-		EnsureSocksCredentials(node)
-		socksUser = node.SocksUser
-		relayPassword = node.SocksPassword
+		socksUser, relayPassword = node.SocksUser, node.SocksPassword
+		if socksUser == "" || relayPassword == "" {
+			// Legacy record the load migration has not reached (only
+			// possible on an in-memory fixture): mint into a throwaway
+			// copy — a read path must never mutate the node record.
+			probe := *node
+			EnsureSocksCredentials(&probe)
+			socksUser, relayPassword = probe.SocksUser, probe.SocksPassword
+		}
 	}
 	uri, ok := BuildClientURI(BuildClientURIParams{
 		Protocol:      node.Protocol,