feat(rustproxy): add authenticated VPN route security

ts/proxies/smart-proxy/models/route-types.ts

@@ -173,6 +173,15 @@ export interface IRouteSecurity {
     expiresIn?: number;
     excludePaths?: string[];
   };
+
+  vpn?: {
+    /** Require authenticated VPN metadata from a trusted PROXY v2 TLV. */
+    required?: boolean;
+    /** Allowed VPN client IDs. Entries can be full-route or domain-scoped. */
+    allowedClients?: Array<string | { clientId: string; domains: string[] }>;
+    /** Allowed VPN tunnel IPs, kept for compatibility. Prefer allowedClients. */
+    allowedAssignedIps?: string[];
+  };
 }
 
 /**
@@ -436,4 +445,4 @@ export interface IRouteQuic {
   initialCongestionWindow?: number;
 }
 
-// Configuration moved to models/interfaces.ts as ISmartProxyOptions
+// Configuration moved to models/interfaces.ts as ISmartProxyOptions