fix(config): persist IPv4 ME NAT overrides through engine tuning

[rmtshnik]

Manual middle_proxy_nat_ip and middle_proxy_nat_probe edits disappear when MTProxyMax regenerates config.toml. Add these IPv4 ME NAT settings to the existing tune whitelist so operators can persist them in tunings.conf and regenerate primary and additional-instance configs without losing them.

Why this change

With destination-based routing (for example, a MikroTik routing Telegram through WireGuard), ordinary public-IP discovery can return the WAN address while Telegram sees the VPN egress address. In the observed deployment, Telemt used the router's WAN address in client_addr_for_kdf; explicitly supplying the actual VPN egress IP restored RPC handshakes for reachable endpoints. TCP timeouts to other endpoints remained a separate routing issue.

The IPv4 egress address belongs to each deployment; it is not a client-facing proxy address and is not hardcoded here. An IP override cannot compensate for source-port translation or an unreachable ME endpoint. A compatible SOCKS egress must return a valid public BND address/port tuple.

Changes

• Allow mtproxymax tune set middle_proxy_nat_ip 203.0.113.10 and mtproxymax tune set middle_proxy_nat_probe false.
• Validate IPv4 octets and the probe boolean before persisting settings. IPv6 NAT override input is intentionally outside this PR's scope; the manager currently generates an IPv4-preferred configuration.
• Reuse existing persistence, TOML quoting, config generation, TUI engine tuning, and tune clear behavior rather than adding a second settings store or a new restart path.
• Document setup, restart behavior, reset commands, and NAT limitations.
• Test invalid-input rejection without altering saved values, repeated regeneration, additional-instance destinations, placement under [general], and clearing back to engine defaults.

No behavior changes when neither override is set. This PR is independent of the Telemt 3.5.14 update and does not change the engine version or automatically import existing manual TOML edits. Operators migrate those values with the documented tuning commands.

Validation

Automated regression and distro tests are run in the linked fork CI. The underlying engine NAT settings were exercised manually in the deployment described above; the new CLI persistence path is covered by the regression test.

Fork CI: https://github.com/rmtshnik/MTProxyMax/actions/runs/39008911285 (all five distro test jobs and systemd/OpenRC integration passed; lint status is visible in the run).