feat: 后端限速实现 + 前端i18n全面国际化 + 安全与代码质量修复

后端:
- trafficmgr: 实现 tc htb 限速（ApplyRateLimit/RemoveRateLimit），自动推导接口名
- 各协议服务: 代码质量改进与错误处理增强

前端:
- protocols.js: 170个硬编码中文字符串全部转为 i18n key，中英文双语翻译
- 提取 fmtBytes() 到 utils/format.js 公共模块（消除 4 处重复）
- router.js: 添加路由级权限守卫，非管理员无法直接 URL 访问管理页
- Tunnels.vue: SSE 日志流改用 fetch+ReadableStream，token 放 Authorization header
- VPNUsers.vue: 修复 catch 块中文硬编码 fallback
- 新增 TaskProgress 组件、taskmgr 后端任务管理

backend/internal/service/wireguard/wireguard.go

@@ -109,10 +109,7 @@ func (s *Service) Validate(cfg map[string]interface{}) (map[string]interface{},
 	if err := service.MustValidate(cfg, "address"); err != nil {
 		return nil, err
 	}
-	out := map[string]interface{}{}
-	for k, v := range cfg {
-		out[k] = v
-	}
+	out := service.CloneConfig(cfg)
 	if !validCIDR(service.Str(out, "address")) {
 		return nil, fmt.Errorf("address 必须是合法 CIDR")
 	}
@@ -131,7 +128,7 @@ func (s *Service) Validate(cfg map[string]interface{}) (map[string]interface{},
 		return nil, fmt.Errorf("allowed_ips: %w", err)
 	}
 	if service.Str(out, "dns") == "" {
-		out["dns"] = "223.5.5.5"
+		out["dns"] = service.DefaultDNS()
 	}
 	if service.Num(out, "keepalive", 0) == 0 {
 		out["keepalive"] = 25
@@ -312,7 +309,7 @@ PresharedKey = %s
 Endpoint = %s
 AllowedIPs = %s
 PersistentKeepalive = %d
-`, sec.PrivateKey, p.ClientAddress, service.StrOr(cfg, "dns", "223.5.5.5"), mtuLine, service.Str(cfg, "server_public_key"), sec.PresharedKey, endpoint, allowed, int(service.Num(cfg, "keepalive", 25))), nil
+`, sec.PrivateKey, p.ClientAddress, service.StrOr(cfg, "dns", service.DefaultDNS()), mtuLine, service.Str(cfg, "server_public_key"), sec.PresharedKey, endpoint, allowed, int(service.Num(cfg, "keepalive", 25))), nil
 	}
 	if requestedID != "" {
 		return "", fmt.Errorf("WireGuard Peer 不存在: %s", requestedID)
@@ -496,11 +493,8 @@ func (s *Service) RemovePeer(t *model.Tunnel, peerID string) error {
 	if raw, ok := secrets["peer_secrets"].(map[string]interface{}); ok {
 		delete(raw, peerID)
 		secrets["peer_secrets"] = raw
-		_ = service.SaveTunnelConfig(t, cfg, secrets)
 	}
-	raw, _ := json.Marshal(cfg)
-	t.Config = string(raw)
-	return s.Create(t)
+	return service.SaveTunnelConfig(t, cfg, secrets)
 }
 
 func loadTrafficState(t *model.Tunnel) map[string][2]int64 {
@@ -813,9 +807,3 @@ func validateCIDRList(value string) error {
 	return nil
 }
 
-func min(a, b int) int {
-	if a < b {
-		return a
-	}
-	return b
-}