release 1.5.0: one panel in all channels; Apple apps (iOS, new macOS tab) only in beta/dev

- stable gets the beta panel and server features (new design, presets, firewall,
  monthly traffic, router failover over all ports/addresses + TCP, altip, HR tab,
  Windows tab, update banner); ios/ macos/ windows/ sources stay out of stable
- menu item "Update to N" under Settings when a new version is out
- mobile: top menu no longer stretches to 200px
- urllib User-Agent: Cloudflare in front of git.bobyrev.com returns 403 to Python-urllib
- docs: GitHub adleibzon-rgb as source, password/uninstall/devices sections,
  new screenshots, PORTS.md TCP fallback and second IP

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ios/Tunnel/WsLink.swift

@@ -1,59 +0,0 @@
-import Foundation
-
-/// Channel «Облако»: one binary WebSocket message = one obfuscated packet, both ways.
-/// pcarelay (C) calls send() for every packet from the obfuscator; received messages go back via pcarelay_ws_in().
-final class WsLink {
-    static let shared = WsLink()
-
-    private let q = DispatchQueue(label: "pca.ws")
-    private let session = URLSession(configuration: .ephemeral)
-    private var url: URL?
-    private var task: URLSessionWebSocketTask?
-
-    func start(_ url: URL) {
-        q.async { self.url = url; self.connect() }
-    }
-
-    func send(_ p: UnsafePointer<UInt8>?, _ n: Int32) {
-        guard let p, n > 0 else { return }
-        let data = Data(bytes: p, count: Int(n))
-        q.async {
-            if self.task == nil { self.connect() }
-            guard let t = self.task else { return }
-            t.send(.data(data)) { [weak self] err in
-                if let err { self?.q.async { if self?.task === t { self?.drop("send: \(err.localizedDescription)") } } }
-            }
-        }
-    }
-
-    private func connect() {
-        guard let url, task == nil else { return }
-        let t = session.webSocketTask(with: url)
-        t.maximumMessageSize = 1 << 20
-        task = t
-        t.resume()
-        NSLog("PCAPhobos ws: connect %@", url.absoluteString)
-        receive(t)
-    }
-
-    private func receive(_ t: URLSessionWebSocketTask) {
-        t.receive { [weak self] result in
-            switch result {
-            case .success(.data(let d)):
-                d.withUnsafeBytes { pcarelay_ws_in($0.bindMemory(to: UInt8.self).baseAddress, Int32(d.count)) }
-                self?.receive(t)
-            case .success:
-                self?.receive(t)
-            case .failure(let err):
-                self?.q.async { if self?.task === t { self?.drop("recv: \(err.localizedDescription)") } }
-            }
-        }
-    }
-
-    /// Next packet from the obfuscator reconnects (WireGuard keepalives make that quick).
-    private func drop(_ why: String) {
-        NSLog("PCAPhobos ws: %@", why)
-        task?.cancel(with: .goingAway, reason: nil)
-        task = nil
-    }
-}