fix(ipsec): не блокироваться на пароле .p12 и подсказать политику sensitive

Co-authored-by: Cursor <[email protected]>

backend/src/services/ipsec-ca.ts

@@ -112,12 +112,12 @@ export async function exportCertificateP12ByName(
   client: MikrotikClient,
   certName: string,
   passphrase: string,
-): Promise<{ fileName: string; content: Buffer; certName: string }> {
+): Promise<{ fileName: string; content: Buffer; certName: string; passphrase: string }> {
   const name = certName.trim()
   const cert = await findCertificate(client, name)
   if (!cert) throw new Error(`Сертификат ${name} не найден на роутере`)
-  const { fileName, content } = await client.exportCertificatePkcs12({ name, passphrase })
-  return { fileName, content, certName: name }
+  const { fileName, content, passphrase: effective } = await client.exportCertificatePkcs12({ name, passphrase })
+  return { fileName, content, certName: name, passphrase: effective }
 }
 
 /** Экспорт клиентского .p12 (сертификат + ключ; CA в цепочке) с роутера. */
@@ -125,6 +125,6 @@ export async function exportClientP12(
   client: MikrotikClient,
   userName: string,
   passphrase: string,
-): Promise<{ fileName: string; content: Buffer; certName: string }> {
+): Promise<{ fileName: string; content: Buffer; certName: string; passphrase: string }> {
   return exportCertificateP12ByName(client, clientCertName(userName), passphrase)
 }