Add custom image handling and access policy management

- Implement tests for custom KVM and LXC image creation, ensuring invalid sources and architecture mismatches are rejected.
- Introduce access policy management in CLI, allowing configuration of allowed sources and trusted proxies.
- Add NAT network configuration with validation for RFC1918 compliance and subnet parsing.
- Create panel access policy management, including normalization and evaluation of access decisions based on client IPs and forwarded headers.
- Develop middleware for enforcing access policies in the server, returning appropriate responses for allowed and denied requests.
- Enhance custom image downloading and validation, ensuring integrity and security of downloaded root filesystem archives.
- Include comprehensive tests for all new functionalities to ensure reliability and correctness.

docs/en/guide/configuration.md

@@ -21,6 +21,23 @@ systemctl restart clicd
 journalctl -u clicd -n 100 --no-pager
 ```
 
+## Panel Access Allowlist CLI
+
+```bash
+# Show the current policy
+clicd access-policy show
+
+# Allow selected addresses and networks; add reverse proxies when needed
+clicd access-policy set \
+  --allow "203.0.113.10,192.168.1.0/24,2001:db8::/32" \
+  --trusted-proxy "127.0.0.1"
+
+# Disable source restrictions
+clicd access-policy disable
+```
+
+The same controls are available from the "Panel access allowlist" item in `clicd cli`. Both paths persist the setting and restart the running panel service automatically.
+
 ## Security Recommendations
 
 - Do not expose the web panel directly to untrusted networks.

docs/en/guide/installation.md

@@ -17,6 +17,8 @@ CLICD provides a one-line installer. By default, it installs the latest version
 curl -fsSL https://raw.githubusercontent.com/MengMengCode/CLICD/main/install.sh | sudo sh
 ```
 
+The installer asks for separate LXC and KVM NAT private subnets. Press Enter to scan host routes, interfaces, bridges, and libvirt networks and select non-overlapping RFC1918 `/24` networks, or enter a CIDR such as `172.28.40.0/24`. For unattended installation, set `CLICD_LXC_SUBNET` and `CLICD_KVM_SUBNET`.
+
 The script defaults to `CLICD_VERSION=latest` and downloads `clicd-linux-amd64.tar.gz` or `clicd-linux-arm64.tar.gz` from `releases/latest` according to the host architecture.
 
 ## Install a Specific Version