feat(nodes): traffic-writer queue, full-mirror sync, WS event fixes

- Traffic-writer single-consumer queue (web/service/traffic_writer.go)
  serialises every DB write that touches up/down/all_time/last_online
  (AddTraffic, SetRemoteTraffic, Reset*, UpdateClientTrafficByEmail) so
  overlapping goroutines can no longer clobber each other's column-scoped
  Updates with a stale tx.Save.

- DB pool: WAL + busy_timeout=10s + synchronous=NORMAL + _txlock=
  immediate, MaxOpenConns=8 / MaxIdleConns=4. The immediate-tx PRAGMA
  fixes residual "database is locked [0ms]" cases where deferred-tx
  writer-upgrade conflicts bypass busy_timeout.

- SetRemoteTraffic full-mirrors node-authoritative state into central:
  settings JSON, remark, listen, port, total, expiry, all_time, enable,
  plus per-client total/expiry/reset/all_time. Inbounds and
  client_traffics rows present on node but missing from central are
  created; rows missing from snap are deleted (with cascading
  client_traffics removal).

- NodeTrafficSyncJob detects structural changes from the mirror and
  broadcasts invalidate(inbounds) so open central UIs re-fetch via REST
  on node-side add/del/edit without manual refresh.

- XrayTrafficJob broadcasts invalidate(inbounds) when auto-disable flips
  client_traffics.enable so the per-client toggle reflects depletion
  without manual refresh.

- Frontend: inbounds page now subscribes to the BroadcastInbounds 'inbounds'
  WS event (full-list pushes from add/del/update controllers were silently
  dropped). Fixes invalidate payload field (dataType -> type). Restart-
  panel modal switched from Promise-wrap to onOk-only so Cancel actually
  cancels.

- Node files trimmed of stale prose-comments; cron cadence dropped
  10s -> 5s to match the inbounds page UX.

- README badges and Go module path bumped v2 -> v3 to match module rename.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

web/runtime/local.go

@@ -10,45 +10,22 @@ import (
 	"github.com/mhsanaei/3x-ui/v3/xray"
 )
 
-// LocalDeps wires the runtime to the panel's xray process and the
-// service.XrayService restart trigger via callbacks. We use callbacks
-// (not an interface to *service.XrayService) because the runtime
-// package would otherwise cycle-import service.
 type LocalDeps struct {
-	// APIPort returns the xray gRPC API port the local engine is
-	// currently listening on. Returns 0 when xray isn't running yet —
-	// callers should treat that as a transient error.
-	APIPort func() int
-	// SetNeedRestart trips the panel's "restart xray on next cron tick"
-	// flag. Mirrors how InboundController.addInbound calls
-	// xrayService.SetToNeedRestart() today.
+	APIPort        func() int
 	SetNeedRestart func()
 }
 
-// Local implements Runtime against the panel's own xray process. Each
-// call follows the existing inbound.go pattern: open a gRPC client,
-// run one operation, close. Per-call init keeps the connection state
-// scoped so a stuck call can't leak across operations.
 type Local struct {
 	deps LocalDeps
-
-	// Serialise gRPC operations — xray's HandlerService isn't documented
-	// as concurrent-safe and the existing InboundService implicitly
-	// runs one op at a time per request. This matches that.
-	mu sync.Mutex
+	mu   sync.Mutex
 }
 
-// NewLocal builds a Local runtime. deps.APIPort and deps.SetNeedRestart
-// are required; callers that want a no-op restart can pass `func(){}`.
 func NewLocal(deps LocalDeps) *Local {
 	return &Local{deps: deps}
 }
 
 func (l *Local) Name() string { return "local" }
 
-// withAPI runs fn against a freshly-initialised XrayAPI client and
-// guarantees Close() afterwards. Returns an error if the gRPC port
-// isn't available yet (xray still starting / stopped).
 func (l *Local) withAPI(fn func(api *xray.XrayAPI) error) error {
 	l.mu.Lock()
 	defer l.mu.Unlock()
@@ -82,17 +59,8 @@ func (l *Local) DelInbound(_ context.Context, ib *model.Inbound) error {
 }
 
 func (l *Local) UpdateInbound(ctx context.Context, oldIb, newIb *model.Inbound) error {
-	// xray-core has no in-place inbound update — drop and re-add.
-	// Matches what InboundService.UpdateInbound did inline.
-	if err := l.DelInbound(ctx, oldIb); err != nil {
-		// Best-effort: continue to AddInbound so a transient remove
-		// failure (e.g. inbound already gone) doesn't strand us. The
-		// caller's needRestart fallback will reconcile from config.
-		_ = err
-	}
+	_ = l.DelInbound(ctx, oldIb)
 	if !newIb.Enable {
-		// Disabled inbounds aren't pushed to xray; we already removed
-		// the old one above.
 		return nil
 	}
 	return l.AddInbound(ctx, newIb)
@@ -117,13 +85,6 @@ func (l *Local) RestartXray(_ context.Context) error {
 	return nil
 }
 
-// Reset methods are intentional no-ops for Local. The central DB UPDATE
-// that runs in InboundService.Reset* before this call has already zeroed
-// the counters that xray reads; on the next stats poll the gRPC service
-// will pick up matching values. Pre-Phase-1 the panel never issued an
-// xrayApi reset call here either — keeping the same shape avoids a
-// behaviour change for single-panel users.
-
 func (l *Local) ResetClientTraffic(_ context.Context, _ *model.Inbound, _ string) error {
 	return nil
 }