feat: manual landing endpoints for forward nodes (item 8)

A forward node's exit target is now a choice: a managed panel server
(existing behavior) or a manual landing endpoint — address + port +
protocol (VLESS / SS2022 / SOCKS5) + operator-supplied credentials,
including third-party nodes the panel does not run. The panel only
builds the entry-side sing-box outbound and route rule; there is no
exit resource, no exit job, and the node is exit-ready by definition.

- model: Node.ExitMode/ExitAddress; manual exits force fixed port mode
  and skip the exit-server port table entirely
- validation: address/port required; per-protocol credential presence;
  SS2022 passwords must be base64 key material of the method's key
  length (one PSK segment or serverKey:userKey) — the exact form
  sing-box accepts, rejected up front instead of failing at deploy
- orchestration: resource building, deploy validation and rebuilds all
  branch on manualExit; switching managed->manual queues removal of the
  old exit resource, manual->managed mints a fresh exit resource id
  (deploy validation previously dereferenced the nil exit server —
  regression test locks the fix)
- UI: exit target segmented control, link paste box that parses
  vless:// / ss:// / socks5:// links into the form, per-protocol
  credential fields (blank keeps the stored value on edit)
- golden: new manualCreate/manualAssign/manualDeploy/manualJobs/
  manualNodes sections — exactly one entry-side job whose outbound
  targets the manual address; all prior sections unchanged
- the generated combined sing-box config passes the real sing-box
  1.13.21 check

panel-go/protocols.go

@@ -499,6 +499,9 @@ type BuildNodeResourceParams struct {
 	Server      *Server
 	BindAddress string
 	ExitServer  *Server
+	// ExitAddress, when non-empty, is the manual landing endpoint the
+	// entry outbound connects to (no managed exit server involved).
+	ExitAddress string
 }
 
 func BuildNodeResource(p BuildNodeResourceParams) (map[string]any, error) {
@@ -522,9 +525,13 @@ func BuildNodeResource(p BuildNodeResourceParams) (map[string]any, error) {
 	if !forward {
 		outbound = map[string]any{"type": "direct", "tag": outboundTag}
 	} else {
-		exitAddr, err := serverAddress(p.ExitServer, networkMode)
-		if err != nil {
-			return nil, err
+		exitAddr := p.ExitAddress
+		if exitAddr == "" {
+			var err error
+			exitAddr, err = serverAddress(p.ExitServer, networkMode)
+			if err != nil {
+				return nil, err
+			}
 		}
 		base := map[string]any{"tag": outboundTag, "server": exitAddr, "server_port": xbDerefInt(node.ExitPort)}
 		creds := node.ExitCredentials