feat(userspace-nat): add VPN metadata to PROXY protocol forwarding

ts/smartvpn.interfaces.ts

@@ -122,10 +122,15 @@ export interface IVpnServerConfig {
    *  Supports exact IPs, CIDR, wildcards, ranges. */
   connectionIpBlockList?: string[];
   /** When true and forwardingMode is 'socket', the userspace NAT engine prepends
-   *  PROXY protocol v2 headers on outbound TCP connections, conveying the VPN client's
-   *  tunnel IP as the source address. This allows downstream services (e.g. SmartProxy)
-   *  to see the real VPN client identity instead of 127.0.0.1. */
+   *  PROXY protocol v2 headers on outbound TCP connections. */
   socketForwardProxyProtocol?: boolean;
+  /** Source address to place into outbound PROXY v2 headers.
+   *  'tunnelIp' preserves legacy behavior. 'remoteIp' exposes the VPN client's
+   *  real connecting IP when known, with tunnel IP fallback. */
+  socketForwardProxyProtocolSource?: 'tunnelIp' | 'remoteIp';
+  /** When true, outbound PROXY v2 headers include authenticated SmartVPN metadata
+   *  in a vendor TLV: clientId, assignedIp, transportType, and remoteAddr. */
+  socketForwardProxyProtocolVpnMetadata?: boolean;
   /** Destination routing policy for VPN client traffic (socket mode).
    *  Controls where decrypted traffic goes: allow through, block, or redirect to a target.
    *  Default: all traffic passes through (backward compatible). */