feat(ui): optional UI_HIDE_* panels; doc WARP free vs paid plans

Hide users/warp/cascade blocks via env; block warp/cascade APIs when hidden.
install.sh passes UI_HIDE_* and restores from previous container on upgrade.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/install.sh

@@ -109,6 +109,26 @@ if [[ -z "${AWG_PROFILES:-}" ]] && [[ -f "${AWG_PROFILE_SNAPSHOT}" ]]; then
   fi
 fi
 
+PREV_CONTAINER_ENV=""
+if docker inspect "${CONTAINER_NAME}" >/dev/null 2>&1; then
+  PREV_CONTAINER_ENV="$(docker inspect "${CONTAINER_NAME}" --format '{{range .Config.Env}}{{println .}}{{end}}' 2>/dev/null || true)"
+fi
+for __ui_var in UI_HIDE_SECTIONS UI_HIDE_USERS UI_HIDE_WARP UI_HIDE_CASCADE; do
+  if [[ -z "${!__ui_var:-}" ]] && [[ -n "${PREV_CONTAINER_ENV}" ]]; then
+    PREV_VAL=""
+    while IFS= read -r __line; do
+      if [[ "${__line}" == "${__ui_var}="* ]]; then
+        PREV_VAL="${__line#*=}"
+        break
+      fi
+    done <<<"${PREV_CONTAINER_ENV}"
+    if [[ -n "${PREV_VAL}" ]]; then
+      printf -v "${__ui_var}" '%s' "${PREV_VAL}"
+      echo "→ ${__ui_var} восстановлен из предыдущего контейнера ${CONTAINER_NAME}."
+    fi
+  fi
+done
+
 DOCKER_BUILD_EXTRA=()
 if [[ "${NO_CACHE:-}" == "1" ]]; then
   DOCKER_BUILD_EXTRA+=(--no-cache)
@@ -152,6 +172,12 @@ for __export_var in CLIENT_CONFIG_ENDPOINT CLIENT_EXPORT_DNS1 CLIENT_EXPORT_DNS2
   fi
 done
 
+for __ui_var in UI_HIDE_SECTIONS UI_HIDE_USERS UI_HIDE_WARP UI_HIDE_CASCADE; do
+  if [[ -n "${!__ui_var:-}" ]]; then
+    RUN_ENV+=( -e "${__ui_var}=${!__ui_var}" )
+  fi
+done
+
 if [[ -n "${BOOT_PW}" ]]; then
   RUN_ENV+=( -e "ADMIN_PASSWORD=${BOOT_PW}" )
 elif [[ "${ALLOW_DEFAULT_PASSWORD:-}" == "1" ]] || [[ "${ALLOW_DEFAULT_PASSWORD:-}" == "true" ]]; then