feat(web): add webhook-managed machine access and multi-instance CLI support (#1989)

* feat: add webhook-managed access and multi-instance CLI support
* fix(foreign): verify credential of foreign credential peer

easytier/src/proto/api_instance.proto

@@ -301,6 +301,7 @@ message GenerateCredentialRequest {
   repeated string allowed_proxy_cidrs = 3; // optional: restrict proxy_cidrs
   int64 ttl_seconds = 4;        // must be > 0: credential TTL in seconds (0 / omitted is invalid)
   optional string credential_id = 5; // optional: user-specified credential id, reused if already exists
+  InstanceIdentifier instance = 6;   // target network instance
 }
 
 message GenerateCredentialResponse {
@@ -310,13 +311,16 @@ message GenerateCredentialResponse {
 
 message RevokeCredentialRequest {
   string credential_id = 1;
+  InstanceIdentifier instance = 2;   // target network instance
 }
 
 message RevokeCredentialResponse {
   bool success = 1;
 }
 
-message ListCredentialsRequest {}
+message ListCredentialsRequest {
+  InstanceIdentifier instance = 1;   // target network instance
+}
 
 message CredentialInfo {
   string credential_id = 1;       // UUID

easytier/src/proto/api_manage.proto

@@ -83,6 +83,8 @@ message NetworkConfig {
   optional bool disable_tcp_hole_punching = 54;
 
   common.SecureModeConfig secure_mode = 55;
+  reserved 56;
+  optional string credential_file = 57;
 }
 
 message PortForwardConfig {
@@ -124,6 +126,7 @@ message NetworkMeta {
   common.UUID inst_id = 1;
   string network_name = 2;
   uint32 config_permission = 3;
+  string instance_name = 4;
 }
 
 message ValidateConfigRequest { NetworkConfig config = 1; }