Replace externalProxy arrays with hosts table entries

3x-ui now renders share-link endpoints from the hosts table, which
supersedes the legacy externalProxy arrays in stream_settings. Remove
those arrays from all four inbounds and insert one host per inbound
instead (inbound_id resolved by tag):

- REALITY: panel domain, 443, security=same (inherits reality params)
- ws / xhttp / trojan-grpc: panel domain, 443, security=tls,
  fingerprint firefox

Also switch the REALITY inbound uTLS fingerprint from chrome to
firefox to match.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CLAUDE.md

@@ -32,7 +32,11 @@ effect on servers only after push to `main`.
 6. Installs 3x-ui panel from MHSanaei/3x-ui latest release (`install_panel`)
 7. Configures nginx (`configure_nginx`) — SNI stream (443 → reality:8443 / panel:7443),
    per-domain vhosts, shared includes snippet, rate-limit zones
-8. Pushes all settings and inbounds into x-ui.db (`configure_xui_db`)
+8. Pushes all settings and inbounds into x-ui.db (`configure_xui_db`).
+   Share-link endpoints use the `hosts` table (supersedes legacy `externalProxy`
+   arrays in stream_settings): one host per inbound — REALITY gets
+   `security=same`, the rest front through nginx :443 with `security=tls`,
+   fingerprint firefox
 9. Installs Clash subscription template (`install_clash_sub`) → `/var/www/subpage/clash.yaml.tpl`;
    Clash/Mihomo user agents get generated clash.yaml, `?provider=1` bypasses it
 10. Downloads a random fake cover site (`install_fake_site`) → `/var/www/html/`

x-ui-latest.sh

@@ -827,9 +827,6 @@ VALUES (
     '{
   "network": "tcp",
   "security": "reality",
-  "externalProxy": [
-    {"forceTls":"same","dest":"${domain}","port":443,"remark":""}
-  ],
   "realitySettings": {
     "show": false,
     "xver": 0,
@@ -845,7 +842,7 @@ VALUES (
     ],
     "settings": {
       "publicKey": "${public_key}",
-      "fingerprint": "chrome",
+      "fingerprint": "firefox",
       "serverName": "",
       "spiderX": "/"
     }
@@ -871,9 +868,6 @@ VALUES (
     '{
   "network": "ws",
   "security": "none",
-  "externalProxy": [
-    {"forceTls":"tls","dest":"${domain}","port":443,"remark":""}
-  ],
   "wsSettings": {
     "acceptProxyProtocol": false,
     "path": "/${ws_port}/${ws_path}",
@@ -897,9 +891,6 @@ VALUES (
     '{
   "network": "xhttp",
   "security": "none",
-  "externalProxy": [
-    {"forceTls":"tls","dest":"${domain}","port":443,"remark":""}
-  ],
   "xhttpSettings": {
     "path": "/${xhttp_path}",
     "host": "${domain}",
@@ -944,9 +935,6 @@ VALUES (
     '{
   "network": "grpc",
   "security": "none",
-  "externalProxy": [
-    {"forceTls":"tls","dest":"${domain}","port":443,"remark":""}
-  ],
   "grpcSettings": {
     "serviceName": "/${trojan_port}/${trojan_path}",
     "authority": "${domain}",
@@ -956,6 +944,17 @@ VALUES (
     'inbound-${trojan_port}',
     '{"enabled":false,"destOverride":["http","tls","quic","fakedns"],"metadataOnly":false,"routeOnly":false}'
 );
+
+-- Hosts supersede the legacy externalProxy arrays: one host per inbound,
+-- rendered as the share-link endpoint at subscription time.
+-- REALITY keeps its own TLS params (security=same); the rest front through
+-- nginx at :443 with TLS.
+INSERT INTO "hosts" ("inbound_id","sort_order","remark","address","port","security","fingerprint")
+VALUES
+    ((SELECT id FROM inbounds WHERE tag='inbound-8443'),           0, 'reality', '${domain}', 443, 'same', ''),
+    ((SELECT id FROM inbounds WHERE tag='inbound-${ws_port}'),     0, 'ws',      '${domain}', 443, 'tls',  'firefox'),
+    ((SELECT id FROM inbounds WHERE tag='inbound-/dev/shm/uds2023.sock,0666:0|'), 0, 'xhttp', '${domain}', 443, 'tls', 'firefox'),
+    ((SELECT id FROM inbounds WHERE tag='inbound-${trojan_port}'), 0, 'trojan',  '${domain}', 443, 'tls',  'firefox');
 EOF
 
     /usr/local/x-ui/x-ui setting \