fix(ci): bump Go to 1.26.4 and exempt /panel/groups SPA route from api-docs test

- Bump go directive to 1.26.4 to pick up stdlib security fixes in
  crypto/x509, mime and net/textproto flagged by govulncheck
- Add /panel/groups to the api_docs_test SPA-page allowlist so the
  UI page route is not treated as an undocumented API endpoint
- go.sum carries pgx/v5 v5.10.0 bump

web/controller/api_docs_test.go

@@ -131,8 +131,8 @@ func TestAPIRoutesDocumented(t *testing.T) {
 		// Skip SPA page routes (these are UI pages, not API endpoints)
 		spaPages := map[string]bool{
 			"/": true, "/panel/": true, "/panel/inbounds": true,
-			"/panel/clients": true,
-			"/panel/nodes":   true, "/panel/settings": true,
+			"/panel/clients": true, "/panel/groups": true,
+			"/panel/nodes": true, "/panel/settings": true,
 			"/panel/xray": true, "/panel/api-docs": true,
 		}
 		if spaPages[r.Path] {