fix(network): согласовать GRE PSK с FastPath и экспортом

backend/src/routes/gre.ts

@@ -98,7 +98,7 @@ function tunnelFromBody(body: z.infer<typeof TunnelWriteSchema> & { keepaliveInt
       keepalive,
       dscp,
       clampTcpMss: body.clampTcpMss,
-      allowFastPath: body.allowFastPath,
+      allowFastPath: body.allowFastPath ?? !body.ipsecSecret?.trim(),
       ipsecSecret: body.ipsecSecret ?? "",
     }],
   }).tunnels[0]!
@@ -122,6 +122,9 @@ const greRoutes: FastifyPluginAsyncZod = async (app) => {
       return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
     }
     const body = parsed.data
+    if (body.ipsecSecret?.trim() && body.allowFastPath === true) {
+      return reply.status(400).send({ error: "IPsec несовместим с FastPath. Отключите FastPath для GRE с PSK." })
+    }
     const server = await getEnabledServerById(body.serverId)
     if (!server) return reply.status(404).send({ error: "Сервер не найден" })
     const client = MikrotikClient.fromServer(server)
@@ -153,6 +156,9 @@ const greRoutes: FastifyPluginAsyncZod = async (app) => {
       if (!live) return reply.status(404).send({ error: "Туннель не найден" })
       if (body.rosId && body.rosId !== live.rosId) return reply.status(409).send({ error: "ID и имя GRE указывают на разные объекты" })
       if (body.name && body.name !== live.name) return reply.status(409).send({ error: "Переименование GRE требует отдельной операции" })
+      if ((body.ipsecSecret ?? live.ipsecSecret).trim() && body.allowFastPath === true) {
+        return reply.status(400).send({ error: "IPsec несовместим с FastPath. Отключите FastPath для GRE с PSK." })
+      }
       const original = state.snapshot.tunnels.find(t => t.name === live.name)!
       const merged = tunnelFromBody({
         serverId: body.serverId,
@@ -168,7 +174,7 @@ const greRoutes: FastifyPluginAsyncZod = async (app) => {
         keepaliveRetries: body.keepaliveRetries ?? parseKeepalive(live.keepalive).retries,
         dscp: body.dscp ?? live.dscp,
         clampTcpMss: body.clampTcpMss ?? live.clampTcpMss,
-        allowFastPath: body.allowFastPath ?? live.allowFastPath,
+        allowFastPath: body.allowFastPath ?? (body.ipsecSecret?.trim() ? false : live.allowFastPath),
         ipsecSecret: body.ipsecSecret ?? live.ipsecSecret,
       })
       // A patch to another field must not reformat an observed native timer.