Add VPN admin tab with subscription proxy via cp-vpn for selected sources.

Persist settings in CA, expose /admin/vpn and /internal/vpn, and route Telegram (and optional web/nlp) traffic through mihomo SOCKS when enabled.

Co-authored-by: Cursor <cursoragent@cursor.com>

centers/analytics/api/app/schemas.py

@@ -300,3 +300,43 @@ class TimelinePoint(BaseModel):
 class TopItem(BaseModel):
     name: str
     count: int
+
+
+class VpnSettingsUpdate(BaseModel):
+    enabled: bool | None = None
+    mode: Literal["subscription", "socks5", "http"] | None = None
+    subscription_url: str | None = None
+    clear_subscription_url: bool | None = None
+    subscription_interval_seconds: int | None = Field(default=None, ge=60, le=86400)
+    host: str | None = None
+    port: int | None = Field(default=None, ge=1, le=65535)
+    username: str | None = None
+    password: str | None = None
+    clear_password: bool | None = None
+    proxied_source_types: list[str] | None = None
+
+
+class VpnSettingsAdminRead(BaseModel):
+    enabled: bool
+    mode: Literal["subscription", "socks5", "http"]
+    subscription_url_set: bool
+    subscription_url_hint: str | None = None
+    subscription_interval_seconds: int
+    host: str | None = None
+    port: int | None = None
+    username: str | None = None
+    password_set: bool
+    proxied_source_types: list[str]
+    available_source_types: list[str]
+
+
+class VpnSettingsInternalRead(BaseModel):
+    enabled: bool
+    mode: Literal["subscription", "socks5", "http"]
+    subscription_url: str | None = None
+    subscription_interval_seconds: int
+    host: str | None = None
+    port: int | None = None
+    username: str | None = None
+    password: str | None = None
+    proxied_source_types: list[str]