release: 1.4.0 — one version for stable/beta/dev

Light/dark theme and compact mobile layout, per-client speed limit, real
speed tests, panel domain (Let's Encrypt), client address + cascade relay,
RKN scanner guard, WARP, backup/restore, router web terminal, Android VPN
client with split tunnelling and Android admin app. Updating from 1.2.x
keeps keys, server.env and clients; tested 1.2.8 -> 1.4.0 on live VMs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/phobos-speedtest.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# PCA Phobos — real server internet speed: download/upload actual bytes, print JSON.
+# Cloudflare speed endpoints first, Hetzner/OVH files as download fallback.
+#   phobos-speedtest.sh [seconds]
+set -uo pipefail
+T="${1:-8}"
+CF="https://speed.cloudflare.com"
+
+down_mbit() {  # $1=url -> Mbit/s
+    curl -s -o /dev/null -m "$T" -w '%{speed_download}' "$1" 2>/dev/null | awk '{printf "%.1f", $1*8/1e6}'
+}
+
+ping_ms() {
+    curl -s -o /dev/null -m 5 -w '%{time_connect}' "$CF/__down?bytes=0" 2>/dev/null | awk '{printf "%.0f", $1*1000}'
+}
+
+dl=$(down_mbit "$CF/__down?bytes=500000000")
+src="cloudflare"
+if [ -z "$dl" ] || awk "BEGIN{exit !($dl < 1)}"; then
+    for u in https://speed.hetzner.de/1GB.bin https://proof.ovh.net/files/1Gb.dat; do
+        dl=$(down_mbit "$u"); src="$u"
+        awk "BEGIN{exit !($dl >= 1)}" && break
+    done
+fi
+ul=$(head -c 200000000 /dev/zero | curl -s -o /dev/null -m "$T" -w '%{speed_upload}' \
+     -X POST --data-binary @- "$CF/__up" 2>/dev/null | awk '{printf "%.1f", $1*8/1e6}')
+printf '{"download_mbit": %s, "upload_mbit": %s, "ping_ms": %s, "source": "%s", "ts": %s}\n' \
+    "${dl:-0}" "${ul:-0}" "$(ping_ms || echo 0)" "$src" "$(date +%s)"