feat(relay): support configurable frps webui port and fix node detail integration

- Implement configurable FRPS WebUI switch and custom port setting (relay_frps_web_ui_port) in system configs.
- Integrate settings into Relay Node detail manage page instead of global settings.
- Dynamically query server version to select matching Docker image tag for Relay installation.
- Clean up legacy code and fix backend linter/test warnings.

internal/apps/openflare/agent/helpers.go

@@ -105,14 +105,6 @@ func applyNodeRuntime(ctx context.Context, node *model.OpenFlareNode, payload No
 	}
 }
 
-func cloneCoordinate(value *float64) *float64 {
-	if value == nil {
-		return nil
-	}
-	cloned := *value
-	return &cloned
-}
-
 func truncateForDatabase(value string, maxVal int) string {
 	if maxVal <= 0 {
 		return ""

internal/apps/openflare/geoip/runtime.go

@@ -37,7 +37,7 @@ func EnsureRuntimeProvider(ctx context.Context) error {
 			runtimeInitErr = err
 			return
 		}
-		runtimeInitErr = applyProviderFromModel()
+		runtimeInitErr = applyProviderFromModel(ctx)
 	})
 	return runtimeInitErr
 }
@@ -47,18 +47,18 @@ func RefreshRuntimeProvider(ctx context.Context) error {
 	if err := model.InitOptionMap(ctx); err != nil {
 		return err
 	}
-	return applyProviderFromModel()
+	return applyProviderFromModel(ctx)
 }
 
-func applyProviderFromModel() error {
+func applyProviderFromModel(ctx context.Context) error {
 	model.OptionMapRWMutex.RLock()
 	provider := strings.TrimSpace(model.GeoIPProvider)
 	model.OptionMapRWMutex.RUnlock()
-	return ApplyProvider(provider)
+	return ApplyProvider(ctx, provider)
 }
 
 // ApplyProvider switches the process-wide GeoIP backend.
-func ApplyProvider(provider string) error {
+func ApplyProvider(ctx context.Context, provider string) error {
 	normalized := strings.TrimSpace(strings.ToLower(provider))
 	if normalized == "" {
 		normalized = pkggeoip.ProviderDisabled
@@ -75,7 +75,7 @@ func ApplyProvider(provider string) error {
 	if normalized == pkggeoip.ProviderMaxMind {
 		path, err := ensureServerMMDB()
 		if err != nil {
-			logger.WarnF(context.Background(), "[GeoIP] seed MaxMind database failed: %v", err)
+			logger.WarnF(ctx, "[GeoIP] seed MaxMind database failed: %v", err)
 		}
 		if path != "" {
 			pkggeoip.GeoIPFilePath = path

internal/apps/openflare/observability/analytics.go

@@ -440,7 +440,7 @@ func matchOpenrestyObservation(
 	observations []*model.OpenFlareNodeObservationOpenresty,
 ) *model.OpenFlareNodeObservationOpenresty {
 	var matched *model.OpenFlareNodeObservationOpenresty
-	var bestDelta time.Duration = metricSnapshotOpenrestyMatchWindow + time.Second
+	bestDelta := metricSnapshotOpenrestyMatchWindow + time.Second
 	for _, observation := range observations {
 		if observation == nil {
 			continue

internal/apps/openflare/relay/helpers.go

@@ -4,10 +4,12 @@
 package relay
 
 import (
+	"context"
 	"net"
 	"strings"
 
 	"github.com/Rain-kl/Wavelet/internal/model"
+	"github.com/Rain-kl/Wavelet/internal/repository"
 )
 
 const (
@@ -83,16 +85,21 @@ func isPublicNodeIP(raw string) bool {
 	return true
 }
 
-func buildRelayConfig(node *model.OpenFlareNode) *Config {
+func buildRelayConfig(ctx context.Context, node *model.OpenFlareNode) *Config {
 	if node == nil {
 		return nil
 	}
+	webServerPort, err := repository.GetIntByKey(ctx, model.ConfigKeyRelayFRPSWebUIPort)
+	if err != nil || webServerPort <= 0 {
+		webServerPort = node.RelayBindPort + 500
+	}
 	return &Config{
 		BindPort:         node.RelayBindPort,
 		VhostHTTPPort:    node.RelayVhostHTTPPort,
 		AuthToken:        node.RelayAuthToken,
 		LogLevel:         "info",
 		WebServerEnabled: node.RelayWebServerEnabled,
+		WebServerPort:    webServerPort,
 	}
 }
 

internal/apps/openflare/relay/logics.go

@@ -98,7 +98,7 @@ func Heartbeat(ctx context.Context, node *model.OpenFlareNode, payload Heartbeat
 	persistRelayHeartbeatObservability(ctx, node.NodeID, payload, now)
 
 	return &HeartbeatResponse{
-		RelayConfig:   buildRelayConfig(node),
+		RelayConfig:   buildRelayConfig(ctx, node),
 		RelaySettings: BuildSettings(node, updateNow, updateChannel, updateTag),
 	}, nil
 }

internal/apps/openflare/tasks/ssl_renew_test.go

@@ -12,6 +12,7 @@ import (
 	"github.com/Rain-kl/Wavelet/internal/config"
 	"github.com/Rain-kl/Wavelet/internal/db"
 	"github.com/Rain-kl/Wavelet/internal/model"
+	"github.com/Rain-kl/Wavelet/internal/task"
 	"github.com/glebarez/sqlite"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -21,11 +22,13 @@ import (
 func setupSSLRenewTestDB(t *testing.T) func() {
 	t.Helper()
 
+	task.RegisterTaskMeta(tls.SSLSingleRenewMeta)
+
 	sqliteDB, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{
 		DisableForeignKeyConstraintWhenMigrating: true,
 	})
 	require.NoError(t, err)
-	require.NoError(t, sqliteDB.AutoMigrate(&model.TLSCertificate{}))
+	require.NoError(t, sqliteDB.AutoMigrate(&model.TLSCertificate{}, &model.TaskExecution{}))
 
 	db.SetDB(sqliteDB)
 	oldSecret := config.Config.App.SessionSecret