Prometheus on a node; panel under a URL prefix; open ports on migrate import

A panel without VPN (e.g. after the move) can use a Prometheus that lives on
a node, such as the one with history left on the old server (node #0). Both
directions go through the agent's WSS: the node's Prometheus scrapes
127.0.0.1:AGENT_METRICS_PORT/metrics, the agent checks its token and asks
core (metrics → metrics_res, the same exposition as /metrics, at most once
per 5 s per connection); the monitor tab reads it back through the agent,
which forwards only GET /-/ready and /api/v1/query[_range]. The panel finds
it by itself (local first, then the lowest-id node), and the install/remove
buttons work on a panel without VPN. `monitor install` on a node without its
own panel picks AGENT_METRICS_PORT, writes it to cli.env and restarts the
agent; on the old server it keeps the collected data.

The panel works behind nginx in a subfolder: relative asset and API paths,
relative directory redirects, and the client address from X-Forwarded-For /
X-Real-IP only from trusted proxies (loopback, TRUST_PROXY).

migrate import opens the moved SUB_PORT/NODE_PORT in UFW when it is active.

internal/cli/migrate.go

@@ -219,6 +219,14 @@ func (c *CLI) migrateImport(file string) {
 		errorf("  Не удалось записать %s: %v", c.envFile, err)
 		os.Exit(1)
 	}
+	// Подписка и хаб переезжают на порты старого сервера — их надо открыть, как install.sh.
+	opened, failed := migrate.OpenFirewall(plan.SubPort, plan.NodePort)
+	if len(opened) > 0 {
+		fmt.Printf("  %s UFW: открыты %s\n", green("✓"), strings.Join(opened, " "))
+	}
+	if len(failed) > 0 {
+		errorf("  UFW: не удалось открыть %s — откройте вручную: ufw allow <порт>/tcp", strings.Join(failed, " "))
+	}
 	c.restartFresh()
 
 	// Сертификат хаба приехал в архиве, а нет — awg-ui создаёт его при старте.