feat(rustproxy): add authenticated VPN route security

ts/proxies/smart-proxy/models/route-types.ts

@@ -173,6 +173,15 @@ export interface IRouteSecurity {
     expiresIn?: number;
     excludePaths?: string[];
   };
+
+  vpn?: {
+    /** Require authenticated VPN metadata from a trusted PROXY v2 TLV. */
+    required?: boolean;
+    /** Allowed VPN client IDs. Entries can be full-route or domain-scoped. */
+    allowedClients?: Array<string | { clientId: string; domains: string[] }>;
+    /** Allowed VPN tunnel IPs, kept for compatibility. Prefer allowedClients. */
+    allowedAssignedIps?: string[];
+  };
 }
 
 /**
@@ -436,4 +445,4 @@ export interface IRouteQuic {
   initialCongestionWindow?: number;
 }
 
-// Configuration moved to models/interfaces.ts as ISmartProxyOptions
+// Configuration moved to models/interfaces.ts as ISmartProxyOptions

ts/proxies/smart-proxy/socket-handler-server.ts

@@ -167,6 +167,7 @@ export class SocketHandlerServer {
       domain: metadata.domain,
       clientIp: metadata.remoteIP || 'unknown',
       serverIp: '0.0.0.0',
+      vpn: metadata.vpn,
       path: metadata.path,
       isTls: metadata.isTLS || false,
       tlsVersion: metadata.tlsVersion,