Restrict Preferred Outbound changes to super admin / admin (deny agents) #5645

Is your feature request related to a problem? Please describe.

In Admin V2, agents (نماینده / Role.agent) can edit a user’s Preferred Outbound (preferred_outbound in user extra_params) via the Users page and the admin API (PATCH user / users-page).

Preferred Outbound controls which server-side outbound all of that user’s traffic leaves through. In reseller / multi-admin setups this is an owner-level routing policy (often tied to capacity, cost, or upstream accounts). Agents should manage users (quota, days, enable/disable) but should not be able to override the owner’s outbound routing—or clear it back to automatic.

Today there is no role check on this field: the same Users API that agents use accepts preferred_outbound for every role in {super_admin, admin, agent}.

Related UI strings (FA): «خروجی ترجیحی» / users.outbound* and admin default outbound («خروجی پیش‌فرض»).

Describe the solution you'd like

1. Agents must not change Preferred Outbound on users (UI: hide or disable the field; API: reject preferred_outbound with 403 if the actor is an agent).
2. Optionally also deny agents from changing admin default outbound (default_outbound on “My account” / admins API) if that is still writable for agents—same policy: outbound routing is owner-controlled.
3. Keep Preferred Outbound editable for super admin and (if desired) full admin; only agents are restricted.
4. Agents may still see the current value (read-only) so they understand routing, unless you prefer to hide it entirely.

Suggested rule of thumb:

• super_admin / admin: read + write
• agent: read-only (or hidden) — write forbidden in UI and API

Describe alternatives you've considered

• Document “don’t touch outbound” for agents — not enforceable; API still allows it.
• Custom panel patch / reverse proxy ACL — breaks on upgrades; we prefer a first-party permission.
• Separate agent-only user editor without outbound — heavier than a role check on one field.

Additional context

• Panel: Hiddify Manager / Admin V2 (e.g. 14.x)
• Relevant areas: Users page → Preferred Outbound; users_page_api applying preferred_outbound; admins default_outbound
• This is a permission / multi-tenant safety request, not a request to remove the Preferred Outbound feature.

خلاصه (فارسی):
الان نماینده می‌تواند «خروجی ترجیحی» کاربر را عوض کند. این تنظیم مسیر خروج ترافیک از سرور است و باید فقط دست ادمین اصلی (و در صورت صلاح‌دید ادمین کامل) باشد. نماینده فقط مدیریت حجم/روز/فعال‌سازی کاربر را داشته باشد؛ تغییر outbound در UI و API برای agent ممنوع شود (۴۰۳).