Panel redesign, per-server I1 masking, node minimum version 0.5.0, installer output

- UI: settings tab with sections (server, API keys, Prometheus, audit, migrate,
  about); server settings moved there; master keys table rework (menu, chips,
  version, compact phone cards); three-state node version chip
- I1: random per-server template (DNS / QUIC Initial / STUN) kept in users.db,
  GET/POST /api/masking, change from the master keys banner
- Hub rejects nodes older than 0.5.0 (close 4026), /ui/nodes reports outdated
- install.sh: spinner for long commands (full output in the log), step progress
  bar, cards; installs older than 0.5.0 require a full reinstall with data reset
- Bump to Beta 0.5.0

internal/agent/agent.go

@@ -511,6 +511,9 @@ func (a *Agent) connectOnce(ctx context.Context, onReady func()) (authFailed boo
 			if code == closeAuthFailed {
 				a.c.Errorf("agent: core отклонил ноду (неверный ключ, просроченная или использованная ссылка)")
 			}
+			if code == 4026 {
+				a.c.Errorf("agent: панель требует обновить ноду (install.sh → «Обновить»): %v", err)
+			}
 			return code == closeAuthFailed
 		}
 		v, err := jsjson.Decode(raw)