Panel redesign, per-server I1 masking, node minimum version 0.5.0, installer output

- UI: settings tab with sections (server, API keys, Prometheus, audit, migrate,
  about); server settings moved there; master keys table rework (menu, chips,
  version, compact phone cards); three-state node version chip
- I1: random per-server template (DNS / QUIC Initial / STUN) kept in users.db,
  GET/POST /api/masking, change from the master keys banner
- Hub rejects nodes older than 0.5.0 (close 4026), /ui/nodes reports outdated
- install.sh: spinner for long commands (full output in the log), step progress
  bar, cards; installs older than 0.5.0 require a full reinstall with data reset
- Bump to Beta 0.5.0

internal/ctrl/awg.go

@@ -344,6 +344,7 @@ func (s *Server) syncPeers() error {
 // vpn:// собирались бы на старых параметрах — например, на 2.0 уже после перехода на 3.1.
 func (s *Server) reloadAwgParams() string {
 	p := ReadParams(s.confPath(), func(m string) { s.log.Warn(m) })
+	p.I1 = s.getCfg(cfgI1, p.I1)
 	s.cfgMu.Lock()
 	s.c.Params = p
 	s.c.Gen = p.Gen()