Add VPN admin tab with subscription proxy via cp-vpn for selected sources.

Persist settings in CA, expose /admin/vpn and /internal/vpn, and route Telegram (and optional web/nlp) traffic through mihomo SOCKS when enabled.

Co-authored-by: Cursor <cursoragent@cursor.com>

centers/parsing/vpn/Dockerfile

@@ -0,0 +1,31 @@
+FROM python:3.12-alpine
+
+ARG MIHOMO_VERSION=1.19.3
+ARG TARGETARCH
+
+RUN apk add --no-cache ca-certificates curl gzip \
+    && arch="${TARGETARCH:-amd64}" \
+    && case "$arch" in \
+         amd64|x86_64) mihomo_arch=amd64 ;; \
+         arm64|aarch64) mihomo_arch=arm64 ;; \
+         *) mihomo_arch=amd64 ;; \
+       esac \
+    && curl -fsSL \
+         "https://github.com/MetaCubeX/mihomo/releases/download/v${MIHOMO_VERSION}/mihomo-linux-${mihomo_arch}-compatible-v${MIHOMO_VERSION}.gz" \
+         -o /tmp/mihomo.gz \
+    && gunzip -c /tmp/mihomo.gz > /usr/local/bin/mihomo \
+    && chmod +x /usr/local/bin/mihomo \
+    && rm -f /tmp/mihomo.gz \
+    && mkdir -p /etc/mihomo/providers
+
+WORKDIR /app
+COPY controller.py /app/controller.py
+
+ENV MIHOMO_BIN=/usr/local/bin/mihomo \
+    MIHOMO_CONFIG_DIR=/etc/mihomo \
+    VPN_SOCKS_PORT=1080 \
+    VPN_POLL_SECONDS=15
+
+EXPOSE 1080
+
+CMD ["python", "-u", "/app/controller.py"]