Panel redesign, per-server I1 masking, node minimum version 0.5.0, installer output

- UI: settings tab with sections (server, API keys, Prometheus, audit, migrate,
  about); server settings moved there; master keys table rework (menu, chips,
  version, compact phone cards); three-state node version chip
- I1: random per-server template (DNS / QUIC Initial / STUN) kept in users.db,
  GET/POST /api/masking, change from the master keys banner
- Hub rejects nodes older than 0.5.0 (close 4026), /ui/nodes reports outdated
- install.sh: spinner for long commands (full output in the log), step progress
  bar, cards; installs older than 0.5.0 require a full reinstall with data reset
- Bump to Beta 0.5.0

internal/ctrl/routes.go

@@ -300,6 +300,12 @@ func (s *Server) routes() []route {
 				{"keepalive", cfg.Keepalive}, {"mtu", cfg.MTU}, {"awg", profileAwg(cfg.Params)}})
 		}),
 
+		// Маскировка первого пакета (I1): посмотреть и сменить. Путь под /api/ — его пропускает
+		// awg-agent нод. Интерфейс не трогается: I1 нужен только клиентам (см. i1.go).
+		R("GET", "/api/masking", false, a, func(c *rctx) (result, error) { return ok(maskingInfo(s.cfg().Params.I1)) }),
+
+		R("POST", "/api/masking", true, a, func(c *rctx) (result, error) { return ok(maskingInfo(s.regenI1())) }),
+
 		R("POST", "/awg/restart", true, a, func(c *rctx) (result, error) {
 			if err := s.restartAwg(); err != nil {
 				return result{}, err