fix(inbounds): carry the Shadowsocks method through the request mapping

inboundReq had no method field, so creating an SS inbound was impossible in
both directions: the strict external decoder rejected the request outright
(unknown field "method"), and the lenient panel decoder dropped the field
silently, leaving the operator's cipher choice to vanish. No model-level test
caught it — they build the Inbound directly, bypassing the request mapping.
Found by driving a real SS client end-to-end against the deployed panel:
tunnel carries traffic and per-user stats attribute it correctly.

Author: AppsGanin

internal/server/inbound_method_test.go

@@ -0,0 +1,32 @@
+package server
+
+import (
+	"testing"
+
+	"github.com/AppsGanin/rospanel/internal/model"
+)
+
+// The Shadowsocks method must survive the request→model mapping. It very nearly
+// didn't: inboundReq had no method field, so the strict external decoder rejected
+// the request outright ("unknown field method") and the lenient panel decoder
+// dropped it silently — an operator's choice of cipher vanishing on the way in,
+// which is the worse of the two. The whole feature is unreachable without this, and
+// no model-level test sees it because they build the Inbound directly.
+func TestInboundReqCarriesShadowsocksMethod(t *testing.T) {
+	req := inboundReq{
+		Name: "ss", Protocol: model.InbShadowsocks, Port: 24900,
+		Method: model.SS2022AES256,
+	}
+	in, err := req.toModel(model.LocalNodeID, 0)
+	if err != nil {
+		t.Fatalf("toModel: %v", err)
+	}
+	if in.Opts.Method != model.SS2022AES256 {
+		t.Errorf("method lost in mapping: got %q, want %q", in.Opts.Method, model.SS2022AES256)
+	}
+	// And it normalizes + validates as a real inbound once the panel fills the key.
+	in.Normalize()
+	if in.Opts.Method != model.SS2022AES256 {
+		t.Errorf("normalize dropped the chosen method: %q", in.Opts.Method)
+	}
+}

internal/server/panel_inbounds.go

@@ -47,6 +47,10 @@ type inboundReq struct {
 	HopEnd      int    `json:"hop_end"`
 	HopInterval string `json:"hop_interval"`
 
+	// Shadowsocks-2022 method. The server key is generated (prepareInbound), so it is
+	// deliberately not a request field.
+	Method string `json:"method"`
+
 	// Advanced. Each transport knob is its own typed field; the three JSON-blob
 	// sections (XHTTP extra, sockopt, extra TLS) arrive as structured forms that the
 	// server assembles into the blob Xray reads. Every form carries a Raw escape hatch
@@ -91,6 +95,7 @@ func (r inboundReq) toModel(serverID, id int64) (model.Inbound, error) {
 			HeaderPaths: r.HeaderPaths,
 			Authority:   r.Authority,
 			MultiMode:   r.MultiMode,
+			Method:      r.Method,
 		},
 	}
 	if r.RealityAntiReplay {