Add VPN admin tab with subscription proxy via cp-vpn for selected sources.

Persist settings in CA, expose /admin/vpn and /internal/vpn, and route Telegram (and optional web/nlp) traffic through mihomo SOCKS when enabled.

Co-authored-by: Cursor <cursoragent@cursor.com>

centers/analytics/api/app/routers/internal.py

@@ -6,9 +6,15 @@ from sqlalchemy.orm import Session
 from ..database import get_db
 from ..deps import verify_internal_token
 from ..models import ParseJob
-from ..schemas import IngestRequest, IngestResponse, ListenerSubscription
+from ..schemas import (
+    IngestRequest,
+    IngestResponse,
+    ListenerSubscription,
+    VpnSettingsInternalRead,
+)
 from ..services.ingest import ingest_events
 from ..services.jobs import resolve_job_source_config
+from ..services.vpn import ensure_vpn_settings, to_internal_read
 
 router = APIRouter(prefix="/internal", tags=["internal"])
 
@@ -85,3 +91,12 @@ def listener_subscriptions(
         )
     db.commit()
     return result
+
+
+@router.get("/vpn", response_model=VpnSettingsInternalRead)
+def internal_vpn_settings(
+    _: None = Depends(verify_internal_token),
+    db: Session = Depends(get_db),
+):
+    row = ensure_vpn_settings(db)
+    return to_internal_read(row)