fix(sub): bake Host VLESS Route into subscription UUIDs

The Host VLESS Route field was stored and shown in the panel but never applied to any generated subscription (raw, JSON, Clash), so the UUID was emitted unmodified (#5655).

Xray reads the route from the UUID's 3rd group (bytes 6-7, net.PortFromBytes) and masks those bytes to zero before authenticating, so a value can be baked into the share/JSON/Clash UUIDs without breaking the user match. A shared applyVlessRoute helper encodes a single 0-65535 value as the 3rd group; empty/invalid/non-UUID input is left unchanged, so legacy data never yields a broken link and no DB migration is needed.

The field was wrongly validated as a multi-segment port spec (that form belongs to the separate server-side routing rule). It is now a single value 0-65535, with frontend validation, link-preview parity (genVlessLink/hostToExternalProxyEntry), hint + error translations across all 13 locales, and tests on every path.

Closes #5655

internal/web/translation/zh-CN.json

@@ -1901,7 +1901,7 @@
         "nodeGuids": "选择从此主机解析的节点。仅用于可视化关联。",
         "serverDescription": "可选备注，显示在备注下方。",
         "allowInsecure": "跳过 TLS 证书验证（allowInsecure / skip-cert-verify）。",
-        "vlessRoute": "通过 VLESS 路由的端口/范围，例如 53,443,1000-2000。留空表示不路由。",
+        "vlessRoute": "嵌入 UUID 的单个 VLESS 路由值（0-65535），例如 443。留空表示不路由。",
         "remark": "此主机的纯文本标签。仅当入站没有自己的备注时，才作为配置名称显示。"
       },
       "remarkVars": {
@@ -1951,7 +1951,7 @@
         "update": "更新主机",
         "delete": "删除主机",
         "badTag": "无效的标签",
-        "badVlessRoute": "请使用端口/范围格式，如 53,443,1000-2000"
+        "badVlessRoute": "请输入 0 到 65535 之间的单个数字"
       }
     }
   },