Marvel panel + 6 features (in-bundle surgical patch)
====================================================
Base: panelkhoshgel-arblant-v15_7_hx79.js (byte-identical to v1.3 release worker.js)
Patched: 2026-10-19 via exact-string anchors mapped from BlueKnight source.

What was added (all inside the bundle, original code untouched):
1. Per-user VLESS UUIDs + quota/expiry/revoke — single choke-point patch at the
   VLESS auth check. Unknown/expired/revoked/over-quota UUIDs get 1008.
   When no users exist, original master-UUID behavior is preserved byte-for-byte.
2. Byte accounting (up/down) per user, flushed to BK_KV on connection close.
   Mid-connection quota cutoff with 4403.
3. New admin UI at /gw-admin/ (Persian RTL, 5 tabs):
   - یوزرها (create/revoke/reset/copy vless link)
   - داشبورد (per-user traffic bars)
   - پروکسی IP (TCP 443 probe from CF edge via cloudflare:sockets)
   - پریست ISP (Irancell fp=unsafe+fragment guide / MCI fp=chrome+ECH guide)
   - بکاپ/ریستور (JSON download/upload)
   API at /gw-admin/api/*, Bearer auth (GW_ADMIN_SECRET, constant-time compare).
4. Telegram bot: NOT in bundle (separate worker) — src/bot.js in panel-gateway,
   needs BotFather token.

Deploy:
- JaSaz: source URL = <host this file somewhere> (do NOT commit to GitHub),
  KV binding name BK_KV, then set secret GW_ADMIN_SECRET in dashboard
  (Workers > Settings > Variables > Secrets).
- Or paste into Workers dashboard Quick Edit.

Verified:
- node --check: syntax OK
- miniflare: /gw-admin/ 200, API 401 without key / 200 with key,
  user create/list work, /api/health 200, /panel/login 200 (original intact)
- NOT verified in production (fresh test account 1101s even the ORIGINAL
  bundle via JaSaz — account-side issue, under investigation).

Secrets:
- GW_ADMIN_SECRET is set by YOU at deploy (pick a strong one).