feat: customer-level credentials shared across all nodes (item 2)

One credential set per customer (UUID + 32-byte root relay key + shortId)
lives on the customer record; node bindings no longer store credentials.
SS2022 user keys derive deterministically from the root key by method
length (16/24/32-byte prefix), so a single password serves every protocol,
matching 3x-ui's per-client credential model. Reality public keys stay a
node property and are shown per binding in the credentials pane.

- store: load-time convergence — first binding's set wins; a converged
  password that is not a 32-byte root key is regenerated (uuid/shortId
  preserved); bindings are stripped; idempotent, covered by tests
- deploy: the orchestrator stamps the customer's set onto a build copy;
  subscriptions resolve the same set; the derivation applies in both the
  inbound builder and the URI builder (verified live: Alice's N1 link is
  byte-identical to the pre-change seed expectation, her N2 user key is
  exactly the root key's 16-byte prefix)
- API: GET /api/customers/:id/credentials returns {credentials, bindings};
  regenerate is now POST /api/customers/:id/credentials/regenerate and
  rotates the whole set, rebuilding every deployed node of the customer
- UI: credentials pane shows the single shared set plus per-binding
  node/protocol/Reality-public-key rows
- golden subscriptions fixture regenerated under one shared set (RF and
  SS entries byte-identical to before; five entries audited by hand)
- golden baseline re-captured for the new shapes; difftest normalizer now
  treats a base64 root key's prefix-truncation encodings and the Surge
  '='-mangled variants as the same secret

panel-go/store.go

@@ -6,6 +6,7 @@ package main
 // the same serialization here.
 
 import (
+	"encoding/base64"
 	"errors"
 	"fmt"
 	"os"
@@ -133,10 +134,70 @@ func (s *Store) Init() error {
 	if err := validateData(&data); err != nil {
 		return err
 	}
+	if MigrateCustomerCredentials(&data) {
+		// Persist the converged credential model immediately, so a crash
+		// before the next transaction cannot resurrect per-binding sets.
+		if err := s.persist(&data); err != nil {
+			return err
+		}
+	}
 	s.Data = &data
 	return nil
 }
 
+// MigrateCustomerCredentials converges legacy per-binding credentials into
+// each customer's single set (round-2 item 2; the 3x-ui model of one
+// credential row per client). Deterministic rules:
+//   - A customer with a complete stored set keeps it.
+//   - Otherwise the set is copied from the customer's first binding (in
+//     stored order) that carries credentials; a customer with no usable
+//     binding credentials gets a fresh set.
+//   - The relay password must be a base64 32-byte root key, because SS2022
+//     user keys derive from it by prefix truncation (EffectiveRelayPassword).
+//     If the converged password does not decode to exactly 32 bytes, only
+//     the password is regenerated — clientId and shortId are preserved.
+//   - Every binding's stored credentials are then cleared, so bindings stop
+//     carrying credentials at all.
+//
+// Returns true when anything changed.
+func MigrateCustomerCredentials(d *Data) bool {
+	changed := false
+	for _, customer := range d.Customers {
+		var creds *Credentials
+		if customer.Credentials != nil && customer.Credentials.ClientID != "" {
+			copied := *customer.Credentials
+			creds = &copied
+		} else {
+			for _, nc := range d.NodeClients {
+				if nc.CustomerID == customer.ID && nc.Credentials != nil && nc.Credentials.ClientID != "" {
+					copied := *nc.Credentials
+					creds = &copied
+					break
+				}
+			}
+		}
+		if creds == nil {
+			fresh := NewCustomerCredentials()
+			creds = &fresh
+		}
+		if raw, err := base64.StdEncoding.DecodeString(creds.RelayPassword); err != nil || len(raw) != 32 {
+			creds.RelayPassword = b64(32)
+		}
+		old := customer.Credentials
+		if old == nil || old.ClientID != creds.ClientID || old.RelayPassword != creds.RelayPassword || old.ShortID != creds.ShortID {
+			customer.Credentials = creds
+			changed = true
+		}
+	}
+	for _, nc := range d.NodeClients {
+		if nc.Credentials != nil {
+			nc.Credentials = nil
+			changed = true
+		}
+	}
+	return changed
+}
+
 // Snapshot returns a deep copy of the current data (JS structuredClone).
 func (s *Store) Snapshot() *Data {
 	s.mu.Lock()