feat(simnet): add SimNet protocol end-to-end support

- model: SimNet protocol fields + NormalizeSimnet; type+port protocol uniqueness
- server config: OmnXT runtime config delivery via compatible() simnet case
- credentials: derive per-user psk/key_id from subscription (pkg/simnet), no new table
- subscription: adapter buildOmnxtSimnetConfigs + base64 buildOmnxtProtocolLinks + OmnXT SimNet application (migration 02161)
- UA gating: hide experimental protocols from non first-party clients (download + JSON node-list)
- admin: normalize simnet on create/update and on GET responses
- tests: 21 simnet unit tests; full suite green

internal/logic/admin/server/createServerLogic.go

@@ -83,6 +83,8 @@ func (l *CreateServerLogic) CreateServer(req *types.CreateServerRequest) error {
 				}
 			}
 		}
+		// Simnet: apply defaults / normalize (no-op for other protocols)
+		protocol.NormalizeSimnet()
 		protocols = append(protocols, protocol)
 	}
 

internal/logic/admin/server/filterServerListLogic.go

@@ -54,6 +54,10 @@ func (l *FilterServerListLogic) FilterServerList(req *types.FilterServerListRequ
 			l.Errorf("[FilterServerList] UnmarshalProtocols Error: %s", err.Error())
 			continue
 		}
+		// Normalize simnet defaults on the response (safe: dst is a fresh slice).
+		for i := range dst {
+			dst[i].NormalizeSimnet()
+		}
 		tool.DeepCopy(&protocols, dst)
 		server.Protocols = protocols
 

internal/logic/admin/server/getServerProtocolsLogic.go

@@ -41,6 +41,12 @@ func (l *GetServerProtocolsLogic) GetServerProtocols(req *types.GetServerProtoco
 		l.Errorf("[FilterServerList] UnmarshalProtocols Error: %s", err.Error())
 		return nil, errors.Wrapf(xerr.NewErrCode(xerr.DatabaseQueryError), "[FilterServerList] UnmarshalProtocols Error: %s", err.Error())
 	}
+	// Normalize simnet defaults on the response so the admin UI always sees a
+	// consistent config even for legacy/hand-inserted rows. dst is a fresh slice
+	// (not shared with the DB), so mutating it here is safe.
+	for i := range dst {
+		dst[i].NormalizeSimnet()
+	}
 	tool.DeepCopy(&protocols, dst)
 
 	return &types.GetServerProtocolsResponse{

internal/logic/admin/server/updateServerLogic.go

@@ -100,6 +100,8 @@ func (l *UpdateServerLogic) UpdateServer(req *types.UpdateServerRequest) error {
 				}
 			}
 		}
+		// Simnet: apply defaults / normalize (no-op for other protocols)
+		protocol.NormalizeSimnet()
 		protocols = append(protocols, protocol)
 	}
 	err = data.MarshalProtocols(protocols)

internal/logic/public/subscribe/queryUserSubscribeNodeListLogic.go

@@ -13,6 +13,7 @@ import (
 	"github.com/perfect-panel/server/internal/types"
 	"github.com/perfect-panel/server/pkg/constant"
 	"github.com/perfect-panel/server/pkg/logger"
+	"github.com/perfect-panel/server/pkg/simnet"
 	"github.com/perfect-panel/server/pkg/tool"
 	"github.com/perfect-panel/server/pkg/xerr"
 	"github.com/pkg/errors"
@@ -20,16 +21,18 @@ import (
 
 type QueryUserSubscribeNodeListLogic struct {
 	logger.Logger
-	ctx    context.Context
-	svcCtx *svc.ServiceContext
+	ctx       context.Context
+	svcCtx    *svc.ServiceContext
+	userAgent string
 }
 
 // Get user subscribe node info
-func NewQueryUserSubscribeNodeListLogic(ctx context.Context, svcCtx *svc.ServiceContext) *QueryUserSubscribeNodeListLogic {
+func NewQueryUserSubscribeNodeListLogic(ctx context.Context, svcCtx *svc.ServiceContext, userAgent string) *QueryUserSubscribeNodeListLogic {
 	return &QueryUserSubscribeNodeListLogic{
-		Logger: logger.WithContext(ctx),
-		ctx:    ctx,
-		svcCtx: svcCtx,
+		Logger:    logger.WithContext(ctx),
+		ctx:       ctx,
+		svcCtx:    svcCtx,
+		userAgent: userAgent,
 	}
 }
 
@@ -163,6 +166,12 @@ func (l *QueryUserSubscribeNodeListLogic) getServers(userSub *user.Subscribe) (u
 			if server == nil {
 				continue
 			}
+			// Hide experimental protocols (simnet) — and their server material in
+			// the raw protocols JSON — from non first-party clients. Mirrors the
+			// Pro reference FilterExperimentalNodesForClient.
+			if simnet.IsExperimentalProtocol(n.Protocol) && !simnet.ClientSupportsExperimental(l.userAgent) {
+				continue
+			}
 			userSubscribeNode := &types.UserSubscribeNodeInfo{
 				Id:              n.Id,
 				Name:            n.Name,

internal/logic/server/constant.go

@@ -12,6 +12,7 @@ const (
 	// Deprecated: Hysteria2 is deprecated, use Hysteria instead
 	// TODO: remove in future versions
 	Hysteria2 = "hysteria2"
+	Simnet    = "simnet"
 )
 
 type SecurityConfig struct {

internal/logic/server/getServerConfigLogic.go

@@ -234,6 +234,22 @@ func (l *GetServerConfigLogic) compatible(config node.Protocol) map[string]inter
 			},
 		}
 
+	case Simnet:
+		// Simnet ships its whole normalized protocol as the node runtime config
+		// (server PSK key_id=0, path, carrier, TLS, AF, fallback, reverse, resource
+		// limits), matching the Pro reference (compat_legacy.go simnet case).
+		config.NormalizeSimnet()
+		// Config snapshot log — non-sensitive fields only (never log the PSK).
+		l.Infow("[GetServerConfig] simnet runtime config",
+			logger.Field("port", config.Port),
+			logger.Field("path", config.SimnetPath),
+			logger.Field("carrier", config.SimnetCarrier),
+			logger.Field("security", config.Security),
+			logger.Field("af_enabled", config.SimnetAfEnabled),
+			logger.Field("fallback_enabled", config.SimnetFallbackEnabled),
+		)
+		result = config
+
 	}
 	var resp map[string]interface{}
 	s, _ := json.Marshal(result)

internal/logic/server/getServerUserListLogic_test.go

@@ -38,6 +38,7 @@ func TestNormalizeServerUserListProtocol(t *testing.T) {
 		{"tuic unchanged", "tuic", "tuic"},
 		{"shadowsocks unchanged", "shadowsocks", "shadowsocks"},
 		{"anytls unchanged", "anytls", "anytls"},
+		{"simnet unchanged", "simnet", "simnet"},
 		{"empty unchanged", "", ""},
 	}
 	for _, c := range cases {

internal/logic/subscribe/simnet_filter.go

@@ -0,0 +1,27 @@
+package subscribe
+
+import (
+	"github.com/perfect-panel/server/internal/model/node"
+	"github.com/perfect-panel/server/pkg/simnet"
+)
+
+// filterExperimentalNodesForClient removes experimental-protocol nodes (simnet)
+// unless the client UA is a first-party client. Prevents generic clients from
+// rendering unusable simnet entries and from receiving simnet server material.
+// Keyword logic is shared via pkg/simnet (mirrors the Pro reference).
+func filterExperimentalNodesForClient(servers []*node.Node, userAgent string) []*node.Node {
+	if simnet.ClientSupportsExperimental(userAgent) {
+		return servers
+	}
+	filtered := make([]*node.Node, 0, len(servers))
+	for _, n := range servers {
+		if n == nil {
+			continue
+		}
+		if simnet.IsExperimentalProtocol(n.Protocol) {
+			continue
+		}
+		filtered = append(filtered, n)
+	}
+	return filtered
+}

internal/logic/subscribe/subscribeLogic.go

@@ -101,6 +101,11 @@ func (l *SubscribeLogic) Handler(req *types.SubscribeRequest) (resp *types.Subsc
 	if err != nil {
 		return nil, err
 	}
+	// Experimental protocols (simnet) are only delivered to their own clients/SDK
+	// (UA hits omnxt/slag/slaglab). Hide them from every other client so a
+	// generic template never renders a broken/unusable node. Mirrors the Pro
+	// reference FilterExperimentalNodesForClient.
+	servers = filterExperimentalNodesForClient(servers, userAgent)
 	a := adapter.NewAdapter(
 		targetApp.SubscribeTemplate,
 		adapter.WithServers(servers),
@@ -109,6 +114,7 @@ func (l *SubscribeLogic) Handler(req *types.SubscribeRequest) (resp *types.Subsc
 		adapter.WithOutputFormat(targetApp.OutputFormat),
 		adapter.WithUserInfo(adapter.User{
 			Password:     userSubscribe.UUID,
+			SubscribeID:  userSubscribe.Id,
 			ExpiredAt:    userSubscribe.ExpireTime,
 			Download:     userSubscribe.Download,
 			Upload:       userSubscribe.Upload,