fix(web): fallback to default secret when database setting is empty

[CaMeDoZa]

Summary

Fixes unhandled HTTP 500 Internal Server Error ("securecookie: hash key is not set") and HTTP 403 Forbidden login failures by ensuring GetSecret() falls back to generating and persisting a default 32-byte secret when the database secret setting is empty.

Why

During database migrations, manual resets, or domain/SSL setup adjustments, if the secret value in SQLite settings becomes an empty string (""), GetSecret() returns empty bytes ([]byte("")). This causes cookie.NewStore in web.go to be initialized with an invalid key, breaking gorilla/securecookie session management and producing 500 errors on /csrf-token and 403 on /login.

Type of change

• Bug fix
• New feature
• Refactoring (no behavior change)
• Documentation
• Tests only
• Build / CI / tooling
• Other

Areas affected

• Frontend (UI / panel pages)
• Backend (API endpoints, login, settings)
• Xray config generation
• Subscription (share links / Clash / JSON)
• Statistics / traffic counters
• Database / migrations
• Install / upgrade script
• Docker image
• Multi-node (sub-nodes)
• Telegram bot

How was this tested?

1. Added a unit test TestGetSecret_FallbacksOnEmptyDatabaseSetting in internal/web/service/setting_security_test.go that verifies GetSecret() generates and persists a 32-byte string when the database secret key is empty.
2. Executed unit tests: go test -v ./internal/web/service/ -run TestGetSecret_FallbacksOnEmptyDatabaseSetting (PASSED).
3. Verified live on a production instance with an empty secret setting: verified /csrf-token returns 200 OK and session authentication completes successfully.

Screenshots / recordings

N/A

Breaking changes

None

Checklist

• I tested the change locally and confirmed the described behavior.
• I added or updated tests for the new behavior (when applicable).
• go build ./... and the test suite pass locally.
• For frontend changes: npm run lint, npm run typecheck, and npm run build pass.
• I updated the Wiki / README / API docs if user-facing behavior changed.
• My commits follow the project's existing message style.
• I have no unrelated changes mixed into this PR.