fix: permission checks for speedId and inPort + multi-node IP constraints (#261)

* feat: restrict user permissions and multi-node IP constraints

- Non-admin users cannot set speedId or inPort on forward create/update
- Multi-entrance tunnels disable custom listen IP for forwards
- Multi-exit tunnels disable custom connect IP
- Multi-node hop chains disable custom connect IP per hop
- Remove tunnel-first-IP fallback in forward ingress resolution
- Add contract tests for non-admin permission restrictions

Entire-Checkpoint: 133693290660

* fix: allow non-admin users to submit null speedId and zero inPort

- Backend: Check speedId is not nil before rejecting non-admin requests
- Backend: Only reject inPort if value > 0 for non-admin users
- Frontend: Only include speedId and inPort in payload for admin users
- Tests: Add contract tests for null speedId and zero inPort cases

.entire/metadata/ses_34c59d587ffeCAUfnH7XWxVTtg/prompt.txt

@@ -0,0 +1 @@
+提交全部变更并且push，创建pr合并，发布新tag，2.1.7-beta3

.entire/metadata/ses_34c59d587ffeCAUfnH7XWxVTtg/summary.txt

@@ -0,0 +1,8 @@
+完成！已成功：
+
+1. **提交变更**: 5个文件（修复绑定IP保留问题 + 新增单元测试）
+2. **推送分支**: opencode/mighty-nebula → origin
+3. **创建PR**: #256 (已合并)
+4. **发布tag**: 2.1.7-beta3
+
+PR #256: https://github.com/Sagit-chu/flvx/pull/256