feat: multi-node device limit, optimize rate limiter

internal/kernel/kernel.go

@@ -73,6 +73,10 @@ type Kernel interface {
 	// The function resolves a user UUID to (limit, hasLimit).
 	// Kernels that already gate-keep internally (e.g. xray) may no-op.
 	SetDeviceLimitFunc(fn func(uuid string) (int, bool))
+	// UpdateGlobalDevices updates the global device state from panel (for multi-node).
+	UpdateGlobalDevices(users map[int][]string)
+	// ClearGlobalDevices clears the global device state (on WS disconnect).
+	ClearGlobalDevices()
 }
 
 // ComputeHash returns a hash of config + user identities that would