feat: 通道组——一次开放多台主机 / 多个端口，共用邀请与授权

- 批量创建：主机支持 IP、主机名、末段范围（10.0.1.11-13）和 主机:端口，
  与端口列表展开为 主机 × 端口，自动分配连续的访问端口，创建前可预览
- 授权以组为单位：一条邀请链接、一次审批即可访问组内全部地址；
  计时从首次连上任一地址开始，撤销一次全组断开；后加入组的通道自动获得组授权
- 网关授权状态按作用范围（通道 / 通道组）存储，通道的动态白名单统一由状态库重新计算，
  通道授权与组授权互不干扰；组内最后一个通道关闭或组被解散时，组的邀请与授权失效
- 闲置联动：组内任一地址在用时整组都不算闲置；支持整组开关
- 已有通道可并入组或移出组；组可改名、追加目标、解散（保留或删除成员）
- App 与网页面板：组卡片、新建 / 编辑通道组、组邀请与“连接与授权”，授权页列出全部地址
- 测试：网关 9 个、Agent 5 个通道组用例

README_EN.md

@@ -58,11 +58,13 @@ PortRelay turns that into three steps:
 - When approval is required, the app shows a system notification and you approve or deny with one click. The requester's page refreshes on its own.
 - **The access clock starts at the first connection**, so a teammate can accept an invite now and use it later.
 - When access expires or is revoked, **existing connections are dropped too**. Unauthorized connections are reset (TCP RST) and logged.
+- **Tunnel groups** open several hosts and ports at once (for example `10.0.1.11-13` × `22, 8080`) on a contiguous block of gateway ports. A group shares one invite link and one set of grants: a teammate is authorized once for the whole group, and one revoke disconnects them everywhere.
 
 **Tunnel lifecycle**
 
 - **Idle auto-close.** The idle timer starts when a tunnel has no connections, no active grants, no pending requests and no invite links with uses left. By default the tunnel closes after 30 minutes of idle time.
 - An optional **maximum open time** closes the tunnel at a fixed point, whether or not it is in use.
+- While any address in a group is in use, the whole group counts as in use; members are switched on and off together.
 - PortRelay records the first-connection time, the actual connected time and why each tunnel was closed.
 - Editing a tunnel keeps existing connections. Moving a tunnel binds the new port before releasing the old one.
 
@@ -104,6 +106,12 @@ PortRelay turns that into three steps:
   </tr>
 </table>
 
+**Tunnel groups.** A group card sums up the state and traffic of the whole group and lists every access address. Each address can be switched, invited or moved out on its own.
+
+<p align="center">
+  <img src="docs/images/app-group.png" alt="Tunnel group" width="100%">
+</p>
+
 **Access management.** Pending requests, authorized devices (with online state and remaining time) and active invite links are all managed in one place.
 
 <p align="center">
@@ -213,6 +221,8 @@ Open ⚙️ Settings and fill in:
 2. Keep the default access mode, **仅授权链接** (invite-only). Click **邀请** (Invite), then choose how long access lasts, how many devices may use the link, and whether approval is required.
 3. Send the generated message or QR code. Once the teammate has entered their name, they can connect their database client or SSH to `192.168.1.10:33660`.
 
+To open several hosts at once (a set of servers, say), click **新建通道组** (New tunnel group), enter hosts `10.0.1.11-13` and ports `22`, check the previewed port mapping and create it, then click **邀请整组** (Invite group). Existing tunnels can be ticked to join the group as well.
+
 ## Configuration
 
 **Gateway: `portrelay-server`**