Panel redesign, per-server I1 masking, node minimum version 0.5.0, installer output

- UI: settings tab with sections (server, API keys, Prometheus, audit, migrate,
  about); server settings moved there; master keys table rework (menu, chips,
  version, compact phone cards); three-state node version chip
- I1: random per-server template (DNS / QUIC Initial / STUN) kept in users.db,
  GET/POST /api/masking, change from the master keys banner
- Hub rejects nodes older than 0.5.0 (close 4026), /ui/nodes reports outdated
- install.sh: spinner for long commands (full output in the log), step progress
  bar, cards; installs older than 0.5.0 require a full reinstall with data reset
- Bump to Beta 0.5.0

internal/ctrl/server.go

@@ -146,6 +146,7 @@ func New() (*Server, error) {
 	sp, _ := strconv.Atoi(portStr)
 
 	params := ReadParams(s.confPath(), func(m string) { s.log.Warn(m) })
+	params.I1 = s.ensureI1() // I1 — из БД, не из conf (см. i1.go)
 	gen := params.Gen()
 	module, tools := readVersions()
 	s.c = Config{