Panel redesign, per-server I1 masking, node minimum version 0.5.0, installer output

- UI: settings tab with sections (server, API keys, Prometheus, audit, migrate,
  about); server settings moved there; master keys table rework (menu, chips,
  version, compact phone cards); three-state node version chip
- I1: random per-server template (DNS / QUIC Initial / STUN) kept in users.db,
  GET/POST /api/masking, change from the master keys banner
- Hub rejects nodes older than 0.5.0 (close 4026), /ui/nodes reports outdated
- install.sh: spinner for long commands (full output in the log), step progress
  bar, cards; installs older than 0.5.0 require a full reinstall with data reset
- Bump to Beta 0.5.0

awg-ui/nodes.ts

@@ -67,9 +67,10 @@ export function createNodes(deps: { uidb: Database.Database; ctrlLocal: Ctrl; ba
         const crtF = file(process.env.NODE_TLS_CERT_FILE, "node_tls.crt");
         try {
             if (!fs.existsSync(keyF) && !fs.existsSync(crtF)) {
+                // CN случайный (12 hex, как имя хоста контейнера): постоянный CN — готовый отпечаток для DPI.
                 const r = spawnSync("openssl", [
                     "req", "-x509", "-newkey", "ec", "-pkeyopt", "ec_paramgen_curve:prime256v1", "-nodes",
-                    "-keyout", keyF, "-out", crtF, "-days", "3650", "-subj", "/CN=awg-node",
+                    "-keyout", keyF, "-out", crtF, "-days", "3650", "-subj", "/CN=" + crypto.randomBytes(6).toString("hex"),
                 ], { stdio: "ignore" });
                 if (r.status !== 0) throw new Error("openssl");
                 fs.chmodSync(keyF, 0o600); fs.chmodSync(crtF, 0o600);