Add VPN admin tab with subscription proxy via cp-vpn for selected sources.

Persist settings in CA, expose /admin/vpn and /internal/vpn, and route Telegram (and optional web/nlp) traffic through mihomo SOCKS when enabled.

Co-authored-by: Cursor <cursoragent@cursor.com>

centers/analytics/api/app/main.py

@@ -13,8 +13,8 @@ for _candidate in (_HERE.parent, *_HERE.parents):
         break
 
 from .database import Base, engine, get_db
-from .routers import admin, auth, internal, map, objects, parse_channels, parser_profiles, v1
-from .seed import seed_objects, seed_test_consumer
+from .routers import admin, auth, internal, map, objects, parse_channels, parser_profiles, v1, vpn
+from .seed import seed_objects, seed_test_consumer, seed_vpn_settings
 from .services.migrations import migrate_schema
 from .services.scheduler import start_scheduler
 from .storage import ensure_upload_dir
@@ -30,6 +30,7 @@ async def lifespan(_: FastAPI):
     try:
         seed_objects(db)
         seed_test_consumer(db)
+        seed_vpn_settings(db)
     finally:
         db.close()
     yield
@@ -53,4 +54,5 @@ app.include_router(auth.router)
 app.include_router(admin.router)
 app.include_router(parser_profiles.router)
 app.include_router(parse_channels.router)
+app.include_router(vpn.router)
 app.include_router(v1.router)