[Bug]: External VLESS nodes lose the encryption field in merged Clash subscriptions

Describe the bug

When a VLESS node with VLESS Encryption enabled is added to another client's subscription as an external entry, the generated Clash/Mihomo YAML omits its encryption field.

The same node's standalone subscription includes the field and connects successfully. After merging it into another subscription, the node times out. Manually restoring the original encryption value makes it work again.

The affected node uses VLESS + TCP + REALITY with mlkem768x25519plus.native.0rtt... encryption.

The UUID is preserved correctly. Flow was changed separately during troubleshooting and is not the issue being reported here.

Related issues:

• #5018
• #5053

Unlike #5018, the encryption value is not incorrectly exported as packet-encoding; it is missing entirely from the externally added node.

How to reproduce the problem

1. Create a VLESS + TCP + REALITY inbound and enable VLESS Encryption using mlkem768x25519plus.native.0rtt.
2. Add two clients to the inbound, each with a different UUID.
3. Obtain the second client's standalone Clash subscription. Confirm that its proxy entry contains the encryption field and connects successfully.
4. Edit the first client and add the second client's exported VLESS share link as an external link.
5. Fetch the first client's Clash subscription, which now contains both nodes.
6. Inspect the externally added node. Its UUID is preserved, but its encryption field is missing.
7. Select that node in the client application. The connection times out.
8. Manually copy the complete encryption value from the working standalone configuration into the affected proxy entry.
9. Test again. The connection works.

I also encountered the problem when adding the second client's HTTPS subscription as an external subscription.

Expected behavior

The merged Clash subscription should preserve the external VLESS node's complete encryption value.

The externally added node should connect successfully with the same connection parameters as its working standalone subscription.

Actual behavior

The generated proxy entry omits encryption, causing the external node to time out.

Relevant excerpt from the working standalone subscription:

name: example-node
type: vless
encryption: "mlkem768x25519plus.native.0rtt.REDACTED"

Corresponding excerpt from the merged subscription:

name: example-node
type: vless
# encryption is missing

These are excerpts, not complete configurations. The actual encryption value has been redacted.

Manually restoring the original encryption field resolves the connection failure.

Relevant logs

No panel or core logs were collected. The evidence is the difference between the standalone and merged subscription outputs, plus the successful connection after manually restoring the encryption field.

Screenshots

Not attached. The relevant configuration difference is provided as text above.

3x-ui version

3.8.5

Xray-core version

26.7.28

How did you install 3x-ui?

install.sh script

Operating system

Debian 12

Which parts of the panel are affected?

Subscription (share links / Clash / JSON)

Browser (only if it is a UI bug)

N/A — the issue affects generated subscription content.

Is the panel behind a reverse proxy or CDN?

No — direct access

Before submitting

• I searched existing issues and this bug has not been reported.
• I am running the latest released version of 3x-ui (or have verified the bug still exists on it).
• This bug report is written in English.
• I have redacted any sensitive data (tokens, real domains, client UUIDs).