feat: Go port of the panel in panel-go/ — drop-in replacement for server.js

Pure-stdlib Go implementation of the whole control plane: same
nexusgate.json schema (unknown fields preserved verbatim, explicit
null/false tri-states modeled), same HTTP API and error strings,
embedded frontend (NG_PUBLIC_DIR override), self-implemented scrypt
auth, X25519 Reality keys, panel-hosted keyStore and heartbeat
reconciliation included. Version stays 0.6.8.

Verified: Go tests 33/33 (scrypt + Reality vectors generated from
the Node implementation, subscription goldens byte-identical),
Node suite 52/52 untouched, differential E2E against the Node
panel 50/50 including two-way DB swap. See panel-go/PARITY.md
and panel-go/INSTALL-GO.md.

panel-go/redact_test.go

@@ -0,0 +1,24 @@
+package main
+
+import "testing"
+
+func TestRedactSecrets(t *testing.T) {
+	cases := []struct{ in, want string }{
+		{"Private Key: abc123", "PrivateKey: [REDACTED]"},
+		{"PrivateKey: abc123", "PrivateKey: [REDACTED]"},
+		{"private key: secret,rest", "PrivateKey: [REDACTED],rest"},
+		{"  Private   Key :  spaced-secret;next", "  PrivateKey: [REDACTED];next"},
+		{"NG_AGENT_KEY=deadbeef", "NG_AGENT_KEY=[REDACTED]"},
+		{"ng_agent_key = deadbeef,more", "NG_AGENT_KEY=[REDACTED],more"},
+		{"Bearer token123", "Bearer [REDACTED]"},
+		{"authorization: bearer token123;", "authorization: Bearer [REDACTED];"},
+		{"nothing to hide", "nothing to hide"},
+		{"", ""},
+		{"Private Key: a NG_AGENT_KEY=b Bearer c", "PrivateKey: [REDACTED] NG_AGENT_KEY=[REDACTED] Bearer [REDACTED]"},
+	}
+	for _, c := range cases {
+		if got := RedactSecrets(c.in); got != c.want {
+			t.Errorf("RedactSecrets(%q) = %q, want %q", c.in, got, c.want)
+		}
+	}
+}