Add conservative Telemt WEB manager with verified updates and rollback

[xPROMSx]

Result

Fixes two release-blocking findings from fresh Ubuntu 26 live acceptance while preserving the conservative Nginx, certificate, locking, systemd and rollback model. Standard Ubuntu MIME data now parses; Telemt eligibility is evaluated by explicit compatibility/health contracts instead of an exact or major/minor version gate. This PR remains open for review and must not be merged automatically.

Live findings and fixes

• The parser formerly treated text/html in types{} as a directive name. MIME records now carry a dedicated data-record flag: generic directive walking and include expansion cannot expose them as listen/server_name/map/include/etc. Flat MIME records are supported, nested records fail closed, ordinary directive-name and include-tree restrictions remain intact, and included bytes stay in integrity snapshots. map{} behavior and both reviewed SNI topologies are preserved.
• The earlier real-Nginx fixtures synthesized nginx.conf without the Ubuntu package mime.types include. Integration tests now obligatorily copy the installed package's exact MIME bytes into the isolated trusted config tree, assert snapshot hash equality, then run real Nginx. This executes for the basic fixture and both pinned 3x-ui-pro topologies.
• Removed install/load/update eligibility gates for 3.5.9. Stable non-draft/non-prerelease metadata, valid SemVer, official URL/architecture asset/digest/archive and candidate version matching remain mandatory. Invalid version output is refused.
• Fresh candidates validate the exact intended generated TOML before Certbot or persistent installation: semantic WEB/write paths, positive healthcheck, strict unknown-key rejection and immutable private-input copies. The same TOML is copied into place and checked again. Startup then requires systemd/owned listener/readiness/path/log contracts; mutation failures roll back.
• Installed runtimes also pass SemVer and current-TOML compatibility probes. Updates compare SemVer, refuse downgrades with both version numbers, preserve equal-version behavior, validate newer candidates before backup/atomic replacement, preserve TOML bytes and roll back runtime failures. No future-release compatibility guarantee is claimed.
• The version-specific, exact 3.5.9 nf_tables warning exception is retained as diagnostic evidence, not release eligibility. Unknown conntrack/severity/permission errors remain fatal.

Preserved scope

Recognized 3x-ui-pro stream/SNI routes and IPv4/IPv6 listeners; unchanged Xray/3x-ui configuration/database; DNS and SOCKS probes; root/path/archive/download protections; strict config, minimal capabilities, readonly filesystem/state boundary; certificate lineage, partial-success ACME, standalone port-80 conflict, canonical deploy hook and scheduler diagnostics. No fastopen support, external include adoption, automatic TOML/Certbot strategy migration or unrelated Nginx reconstruction.

Current upstream, independently rechecked

• Latest stable Telemt 3.5.7, draft=false/prerelease=false, target 4ca7418442478cd92f9e861c21977a81b249efc8.
• Telemt 3.5.8 and 3.5.9 currently prereleases. Main/3.5.9 source baseline: e3f62db3474fdad12b4b9a20bdbac59b26b311bb.
• Official GNU asset digests for 3.5.7 and 3.5.9 were verified before executing their strict direct/SOCKS tests. The explicit historical prerelease test does not alter automatic stable selection.
• mozaroc/3x-ui-pro main and pinned tested revision remain a2c430cd6dec7c86d873dcda3544a61e7ac41144.

Validation

Final HEAD f08d9c3.
Actions run 36857914515, safety job 110354726440: SUCCESS, every step passed.

• Bash syntax, ShellCheck, all 39 Python tests (32 retained plus 7 new MIME/SemVer regressions).
• Actual Ubuntu package mime.types parse/snapshot and real Nginx stream/PROXY/TLS/XFF on all three integration fixtures.
• Future 42.7.123 fresh acceptance and pre-issuance incompatible rejection; compatible update with byte-identical TOML; rejected incompatible/no-op/input-mutating candidate; activated runtime failure rollback; equal versions; 3.5.7 versus installed 3.5.9 downgrade refusal; malformed versions; draft/prerelease metadata.
• Official verified 3.5.7 and 3.5.9 strict direct/SOCKS contracts and unknown-key rejection.
• Existing archive/digest/asset negatives, readiness, update/Nginx rollback, lock races, ACME partial success/signals, renewal ownership/hooks/schedulers, actual Noble nf_tables and both full pinned installer/patcher topologies.

Local syntax/lint/Python/configuration and fixture tests passed. Local real-Nginx execution, network namespaces and renewal PID/owner checks are constrained by the cloud container UID/proc/capability model; their unmodified full tests passed in Actions. English/Russian commands and docs links remain consistent. Changed files were scanned for private keys/tokens and non-example IPs; no production data was introduced.

Remaining acceptance boundary

Repeat fresh Ubuntu 26 live acceptance: actual systemd startup, real ACME issuance/renewal/deploy reload, WARP-backed SOCKS egress and Telegram WEB client traffic. Future candidates are conditionally evaluated, never guaranteed compatible. Unknown contracts fail closed; power loss/SIGKILL/disk failure/external root edits require manual recovery.
No known additional release blocker was identified by the final diff review and CI. Main remains unchanged; PR unmerged; no new PR, release, tag, force push, history rewrite or production access.