tg-ws-proxy-rs v2.2.3

This release adds a deliberately small OpenWrt integration without changing the
proxy protocol or Rust configuration surface.

New

• A one-line OpenWrt installer uses the existing static musl release archives and
  maps DISTRIB_ARCH to AArch64, ARMv7, MIPS, MIPSel or x86_64.
• --upx explicitly selects the existing flash-saving UPX archive; the regular
  binary remains the default.
• luci-app-tg-ws-proxy provides UCI/procd integration, a page under
  Services → Telegram WS Proxy, service controls and a filtered live logd
  view.
• OpenWrt 25.12+ receives an architecture-independent APK; OpenWrt 24.10 receives
  the corresponding IPK.
• Stable and beta release channels are supported by the same installer and
  release workflow.

Distribution model

The proxy binary is not repackaged as APK/IPK. Release CI builds the normal musl
binaries once, publishes regular and UPX archives, and separately builds only the
architecture-independent LuCI integration from one standard OpenWrt package
recipe. A shared SHA256SUMS covers the Linux archives and both LuCI packages.

The unsigned LuCI APK is installed with an explicit --allow-untrusted policy
after verification against the immutable digest from the GitHub release API.
Download mirrors can provide payloads but cannot override expected digests. IPK
installation does not require an architecture bypass.

Upgrade safety

Before replacing /usr/bin/tg-ws-proxy, the installer verifies asset digests,
extracts the selected archive and executes its --version command. It backs up
the existing binary, UCI config and service state, performs an atomic binary
replacement, then verifies procd and the listening socket. Failed binary startup
restores the previous binary/config/service state. The UCI config is restricted
to mode 0600, and only the three newest installer backups are kept after a
successful installation.

One-time secret generation and logging migration run during installation rather
than mutating UCI from the normal service start path.