fix: implement CloseByUUID and move v1 token from URL to POST body

CloseByUUID: add UUID→connIDs reverse index so ban-user actually
tears down existing TCP connections immediately instead of no-op.

v1 token: change config/user fetches from GET (token in URL, leaks
to logs) to POST (token in JSON body). Panel routes updated to any().

internal/panel/client.go

@@ -200,6 +200,10 @@ func decodeWeakRaw(input map[string]interface{}, output interface{}) error {
 
 // configPath returns the API path for config fetching.
 // Machine mode uses the v2 endpoint; legacy mode uses the v1 UniProxy endpoint.
+// fetchMethod returns POST for all API calls (token stays in body, not URL).
+// v2 already used POST; v1 legacy endpoints need panel route update to match.
+func (c *Client) fetchMethod() string { return "POST" }
+
 func (c *Client) configPath() string {
 	if c.machineID > 0 {
 		return "/api/v2/server/config"
@@ -217,7 +221,7 @@ func (c *Client) userPath() string {
 
 // GetConfig fetches node configuration. Returns nil if not modified (304).
 func (c *Client) GetConfig() (*NodeConfig, error) {
-	resp, err := c.doRequest("GET", c.configPath(), nil, c.configETag)
+	resp, err := c.doRequest(c.fetchMethod(), c.configPath(), nil, c.configETag)
 	if err != nil {
 		return nil, fmt.Errorf("get config: %w", err)
 	}
@@ -255,7 +259,7 @@ func (c *Client) GetConfig() (*NodeConfig, error) {
 
 // GetUsers fetches available users. Returns nil if not modified (304).
 func (c *Client) GetUsers() ([]User, error) {
-	resp, err := c.doRequest("GET", c.userPath(), nil, c.userETag)
+	resp, err := c.doRequest(c.fetchMethod(), c.userPath(), nil, c.userETag)
 	if err != nil {
 		return nil, fmt.Errorf("get users: %w", err)
 	}