feat(panel): build-before-bind + socks5 fixed node account (items 20+21)

Item 20: drop the zero-client deploy gate in ValidateNodeDeploy for
all protocols, stop RebuildNode from auto-removing a node whose
bindings reach zero, and let server/heartbeat reconciliation rebuild
zero-client nodes like any other. Nodes are built and deployed first;
bindings can be added and removed freely.

Item 21: socks5-auth nodes carry one node-level fixed account
(node.socksUser/socksPassword, minted at creation or by the store-load
migration MigrateSocksNodeCredentials, idempotent). The sing-box
inbound's only user is that pair regardless of bindings; subscription
links for every bound customer carry the same pair. The generated
username avoids the ng: prefix so the agent never attributes the
account's traffic to a customer — it stays on the node's inbound
counters. Edit form shows both fields (copyable) for socks nodes;
NormalizeNode validates operator-supplied usernames.

panel-go/types.go

@@ -735,6 +735,13 @@ type Node struct {
 	AutoRemoving       *bool                      `json:"autoRemoving,omitempty"`
 	WSPath             *string                    `json:"wsPath,omitempty"`
 	SSServerKey        *string                    `json:"ssServerKey,omitempty"`
+	// SocksUser/SocksPassword are the node-level fixed account of a
+	// socks5-auth inbound (round-3 item 21, the 3x-ui inbound model):
+	// the inbound's only user, carried by every subscriber's link for
+	// this node. Empty on legacy records until the store-load migration
+	// (MigrateSocksNodeCredentials) mints a pair.
+	SocksUser     string `json:"socksUser,omitempty"`
+	SocksPassword string `json:"socksPassword,omitempty"`
 	Reality            *RealityConfig             `json:"reality,omitempty"`
 	ExitCredentials    *ExitCredentials           `json:"exitCredentials,omitempty"`
 	UsageCounters      *UsageCounters             `json:"usageCounters"`