fix(vite): treat /panel/xray as SPA page, not API root

The dev-server bypass classified /panel/xray as an API path because
the PANEL_API_PREFIXES matcher did `stripped === prefix.replace(/\/$/, '')`,
which made the bare path collide with the SPA route of the same name
(see web/controller/xui.go: g.GET("/xray", a.panelSPA)).

On reload, /panel/xray got proxied to the Go backend instead of being
served by Vite. The backend returned the embedded built index.html
with hashed asset names that the dev server doesn't have, so every
asset 404'd.

Prefix-only match for trailing-slash entries fixes it: panel/xray/...
still routes to the API, but panel/xray itself reaches the SPA branch.

frontend/vite.config.js

@@ -87,7 +87,9 @@ function bypassMigratedRoute(req) {
   if (url.startsWith(basePath)) {
     const stripped = url.slice(basePath.length);
     for (const prefix of PANEL_API_PREFIXES) {
-      if (stripped === prefix.replace(/\/$/, '') || stripped.startsWith(prefix)) {
+      if (prefix.endsWith('/')) {
+        if (stripped.startsWith(prefix)) return undefined;
+      } else if (stripped === prefix || stripped.startsWith(prefix + '/')) {
         return undefined;
       }
     }