fix: v4.0.1 routing, Trial controls & installer reliability

[roseshayan]

SpeedyBot v4.0.1

Production-feedback patch for Issue #1 and installer UX.

Fixed

• Direct configs prefer the real public 3x-ui subscription body (plain/Base64) so manual links match Subscription output.
• Trial/Plan Inbound selection now shows effective state correctly; default empty DB selection is rendered as all active.
• Removing an Inbound from default-all mode now persists an explicit all-except-that-Inbound selection.
• Attach/Detach is verified by re-reading the client's actual inboundIds from 3x-ui; mismatches fail instead of silently succeeding.
• Installer makes hidden Bot/API token input explicit, confirms receipt without revealing secrets, and retries invalid Bot Token input.

Added

• Global Trial GB / days / IP-limit settings.
• Improved live Trial/Inbound admin screen.
• Safe deletion for unused plans.
• Safe category deletion with plan reassignment.
• Unit tests for subscription decoding and Inbound toggle semantics.

Safety

• Existing .env, SQLite data, users, transactions and services are preserved.
• Plans with transaction history cannot be hard-deleted.
• At least one active Inbound must remain selected.

Closes no issue automatically; Issue #1 should stay open until the reporter confirms the fix on a real panel.