Pin native Xray transport params to xray-core defaults; keep only safe knobs

Remove the transport-shaping tuning footguns that could break data flow if
misconfigured, and hardcode them to xray-core / Go net/http2 defaults instead:

- HTTP/2: stop overriding MaxConcurrentStreams and the per-conn/per-stream upload
  buffers; use Go's defaults exactly like xray-core's splithttp hub does.
- XHTTP reorder buffer default is now 30 (xray-core scMaxBufferedPosts), still
  overridable per-inbound from the generated config.
- Mux per-connection session cap, mux UDP idle/read/write buffers, and the XHTTP
  session cap are now fixed constants rather than admin knobs.

The XrayNativeTuning struct and admin UI keep only the operator-safe controls:
Go GOMAXPROCS, the global mux-session DoS cap, and the packet-trace debug toggle.
Old config.json files with the removed keys still load (unknown fields ignored).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

xray_xhttp.go

@@ -99,11 +99,9 @@ func mergeNativeXHTTPSettings(primary, fallback nativeXHTTPSettingsJSON) nativeX
 
 func (ib *nativeInbound) serveXHTTPListener(ln net.Listener) {
 	defer xrayRecover(fmt.Sprintf("native xray XHTTP listener inbound=%q addr=%s", ib.tag, ln.Addr()))
-	h2s := &http2.Server{
-		MaxConcurrentStreams:         uint32(nativeH2MaxConcurrentStreams()),
-		MaxUploadBufferPerConnection: int32(nativeH2UploadBufferConn()),
-		MaxUploadBufferPerStream:     int32(nativeH2UploadBufferStream()),
-	}
+	// Match xray-core: let net/http's HTTP/2 use its own defaults for flow
+	// control, stream limits and upload buffers instead of overriding them.
+	h2s := &http2.Server{}
 	handler := http.Handler(ib)
 	// Official Xray accepts plaintext HTTP/1.1 and h2c on non-TLS XHTTP
 	// listeners, and negotiates h2/http1 through ALPN on TLS listeners. Without