Add VPN admin tab with subscription proxy via cp-vpn for selected sources.

Persist settings in CA, expose /admin/vpn and /internal/vpn, and route Telegram (and optional web/nlp) traffic through mihomo SOCKS when enabled.

Co-authored-by: Cursor <cursoragent@cursor.com>

centers/analytics/frontend/src/api/admin.ts

@@ -14,6 +14,8 @@ import type {
   ParseJobUpdate,
   TimelinePoint,
   TopItem,
+  VpnSettings,
+  VpnSettingsUpdate,
 } from "../types/admin";
 
 function buildQuery(params: Record<string, string | number | undefined>): string {
@@ -157,3 +159,15 @@ export async function testDistribution(apiKey: string, limit = 5): Promise<Event
   }
   return response.json() as Promise<EventRecord[]>;
 }
+
+export function fetchVpnSettings(): Promise<VpnSettings> {
+  return request<VpnSettings>("/vpn", undefined, ADMIN_BASE);
+}
+
+export function updateVpnSettings(payload: VpnSettingsUpdate): Promise<VpnSettings> {
+  return request<VpnSettings>(
+    "/vpn",
+    { method: "PUT", body: JSON.stringify(payload) },
+    ADMIN_BASE,
+  );
+}