fix(client): clear group when removed in the single-client editor

SyncInbound deliberately preserves a stored group when the inbound settings
carry none, so node snapshots and group-less rebuilds can't wipe it. That
guard also meant removing the group in the single-client editor never took
effect: the client kept showing under the old group after save.

Persist the group explicitly in ClientService.Update (the single-edit path),
like reverse, including the empty string that clears it. The editor always
round-trips the field, so this is safe; bulk and the Groups page are
unchanged. Add TestClientUpdate_ClearsGroup.

internal/web/service/client_crud.go

@@ -396,6 +396,18 @@ func (s *ClientService) Update(inboundSvc *InboundService, id int, updated model
 		return needRestart, err
 	}
 
+	// Persist the group explicitly. SyncInbound deliberately preserves the
+	// stored group when the inbound settings carry none — so a node snapshot or a
+	// group-less settings rebuild can't wipe it (see SyncInbound + its tests).
+	// That guard also meant clearing the group in the client editor never took
+	// effect. The editor always round-trips the field, so apply it here,
+	// including the empty string that removes the client from its group.
+	if err := database.GetDB().Model(&model.ClientRecord{}).
+		Where("id = ?", id).
+		UpdateColumn("group_name", updated.Group).Error; err != nil {
+		return needRestart, err
+	}
+
 	if err := database.GetDB().Model(&model.ClientRecord{}).
 		Where("id = ?", id).
 		UpdateColumn("updated_at", time.Now().UnixMilli()).Error; err != nil {

internal/web/service/client_group_node_sync_test.go

@@ -2,6 +2,7 @@ package service
 
 import (
 	"path/filepath"
+	"strings"
 	"testing"
 
 	"github.com/mhsanaei/3x-ui/v3/internal/database"
@@ -116,3 +117,77 @@ func TestSyncInbound_KeepsGroupWhenIncomingEmpty(t *testing.T) {
 		t.Errorf("group must survive a group-less settings rebuild (it is managed via the Groups page, not Xray settings): got %q, want %q", row.Group, wantGroup)
 	}
 }
+
+// Removing the group in the client editor and saving must clear group_name and
+// drop the settings "group" key, even though SyncInbound preserves a group on a
+// group-less rebuild. The editor round-trips the field, so ClientService.Update
+// applies it explicitly.
+func TestClientUpdate_ClearsGroup(t *testing.T) {
+	dbDir := t.TempDir()
+	t.Setenv("XUI_DB_FOLDER", dbDir)
+	if err := database.InitDB(filepath.Join(dbDir, "x-ui.db")); err != nil {
+		t.Fatalf("InitDB: %v", err)
+	}
+	t.Cleanup(func() { _ = database.CloseDB() })
+
+	db := database.GetDB()
+
+	const email = "[email protected]"
+	const uid = "ce8d33df-3a64-4f10-8f9b-91c3a8e0c005"
+	const wantGroup = "vip"
+
+	ib := &model.Inbound{
+		UserId:   1,
+		Tag:      "vless-clear",
+		Enable:   true,
+		Port:     20003,
+		Protocol: model.VLESS,
+		Settings: `{"clients":[{"email":"` + email + `","id":"` + uid + `","enable":true,"group":"` + wantGroup + `"}]}`,
+	}
+	if err := db.Create(ib).Error; err != nil {
+		t.Fatalf("create inbound: %v", err)
+	}
+
+	svc := ClientService{}
+	inboundSvc := &InboundService{}
+
+	// Seed the client record + inbound link from the settings.
+	seedClients, err := inboundSvc.GetClients(ib)
+	if err != nil {
+		t.Fatalf("GetClients: %v", err)
+	}
+	if err := svc.SyncInbound(nil, ib.Id, seedClients); err != nil {
+		t.Fatalf("seed SyncInbound: %v", err)
+	}
+
+	var rec model.ClientRecord
+	if err := db.Where("email = ?", email).First(&rec).Error; err != nil {
+		t.Fatalf("lookup seeded record: %v", err)
+	}
+	if rec.Group != wantGroup {
+		t.Fatalf("setup: group not seeded, got %q", rec.Group)
+	}
+
+	// Edit the client and remove the group.
+	updated := *rec.ToClient()
+	updated.Group = ""
+	if _, err := svc.Update(inboundSvc, rec.Id, updated); err != nil {
+		t.Fatalf("Update (clear group): %v", err)
+	}
+
+	var after model.ClientRecord
+	if err := db.Where("email = ?", email).First(&after).Error; err != nil {
+		t.Fatalf("lookup record after update: %v", err)
+	}
+	if after.Group != "" {
+		t.Errorf("group not cleared after editor removed it: got %q, want empty", after.Group)
+	}
+
+	var ibAfter model.Inbound
+	if err := db.First(&ibAfter, ib.Id).Error; err != nil {
+		t.Fatalf("lookup inbound after update: %v", err)
+	}
+	if strings.Contains(ibAfter.Settings, `"group"`) {
+		t.Errorf("inbound settings still carry a group key after removal: %s", ibAfter.Settings)
+	}
+}