Add VPN admin tab with subscription proxy via cp-vpn for selected sources.

Persist settings in CA, expose /admin/vpn and /internal/vpn, and route Telegram (and optional web/nlp) traffic through mihomo SOCKS when enabled.

Co-authored-by: Cursor <cursoragent@cursor.com>

centers/analytics/api/app/routers/vpn.py

@@ -0,0 +1,32 @@
+"""Admin VPN / proxy settings."""
+
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, HTTPException
+from sqlalchemy.orm import Session
+
+from ..database import get_db
+from ..deps import verify_admin
+from ..schemas import VpnSettingsAdminRead, VpnSettingsUpdate
+from ..services.vpn import apply_vpn_update, ensure_vpn_settings, to_admin_read
+
+router = APIRouter(
+    prefix="/admin/vpn",
+    tags=["vpn"],
+    dependencies=[Depends(verify_admin)],
+)
+
+
+@router.get("", response_model=VpnSettingsAdminRead)
+def get_vpn_settings(db: Session = Depends(get_db)):
+    row = ensure_vpn_settings(db)
+    return to_admin_read(row)
+
+
+@router.put("", response_model=VpnSettingsAdminRead)
+def put_vpn_settings(payload: VpnSettingsUpdate, db: Session = Depends(get_db)):
+    try:
+        row = apply_vpn_update(db, payload)
+    except ValueError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
+    return to_admin_read(row)