experimental/clashapi: emit "user" field in TrackerMetadata.MarshalJSON

[PavelLizunov]

Summary

TrackerMetadata.MarshalJSON (in experimental/clashapi/trafficontrol/tracker.go)
emits a fixed set of metadata keys but silently drops the authenticated
user identifier. This PR adds a single key "user": t.Metadata.User to
the marshalled JSON.

Why

adapter.InboundContext.User is populated server-side by every auth-bearing
inbound (VLESS, TUIC, Trojan, etc) — the data exists, it just never
reaches the Clash-API wire. Downstream consumers that need per-user
attribution (abuse detection, per-account quota visualisation,
multi-tenant dashboards) have no way to associate a connection with the
account that opened it.

What changes

"metadata": map[string]any{
    "network":         t.Metadata.Network,
    "type":            inbound,
+   "user":            t.Metadata.User,    // ← added
    "sourceIP":        t.Metadata.Source.Addr,
    ...
}

For inbounds WITHOUT an authenticated user (direct/socks/tun) User is
the empty string — preserves existing observable behaviour for those
inbounds.

Compatibility

• No schema migration — JSON object gets one new optional key.
• No protocol break — Clash-API clients ignore unknown fields per
  the de-facto convention.
• No server-side behaviour change — the field is already populated
  upstream of MarshalJSON; this only changes what gets marshalled.

Real-world driver

A Rust-based VPN-fleet control plane (github.com/PavelLizunov/vpnctl)
polls clash-api on each node to attribute per-connection traffic to
inv.db user_ids. The attribution column in its vpn_connection_stats
table is NULL on every row today because User is never on the wire —
even though authenticated VLESS connections populate it server-side.

Test plan

• Builds clean (1-line addition to an existing literal).
• Manual: enable clash-api on a dev sing-box, authenticate via VLESS,
  curl localhost:9090/connections → metadata now contains "user": "<uuid-or-name>".
• Unauthenticated inbound (direct/tun) still emits "user": "" (no regression).