Harden node lifecycle and API handling

[Rerowros]

Summary

• fail closed when API_KEY is missing, malformed, or the zero UUID
• make backend stop/replacement serializable and prevent a stale keepalive worker from stopping a replacement backend
• return real gRPC empty responses and propagate streaming receive failures
• surface failed Xray runtime user removal instead of falsely confirming revocation
• set HTTP deadlines/body limits and validate WireGuard ticker intervals

Validation

• go test ./controller — passed
• go vet ./...
• git diff --check

Known test-environment limitation

Existing REST/gRPC integration suites require TLS fixtures absent from this checkout; their packages compile before TestMain exits.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 37271252-202a-40f6-819c-c4677f266dd1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}