feat(ipsec): enhance IPsec management with peer and certificate handling

- Added support for managing IPsec peers, including editing and deleting functionality.
- Introduced a new UI component for displaying peers and their details within the IPsec server grid.
- Updated the IPsec user creation form to allow binding identities to specific peers.
- Enhanced backend routes and services to handle peer patching and deletion requests.
- Improved data structures to accommodate multiple peers and certificates for each server.
- Added tests to ensure proper functionality of new peer management features.

packages/contracts/src/ipsec.ts

@@ -88,7 +88,10 @@ export const ipsecServerSummaryDtoSchema = z.object({
   /** Managed-набор (CA + серверный серт + peer + mode-config) инициализирован. */
   initialized: z.boolean(),
   serverEndpoint: z.string().optional(),
+  /** Primary managed peer (обратная совместимость); для полного списка — `peers`. */
   peer: ipsecPeerDtoSchema.optional(),
+  /** Все peers роутера (managed + существующие). */
+  peers: z.array(ipsecPeerDtoSchema).default([]),
   pool: ipsecPoolDtoSchema.optional(),
   sharedModeConfig: ipsecModeConfigDtoSchema.optional(),
   caCert: ipsecCertInfoDtoSchema.optional(),
@@ -96,9 +99,24 @@ export const ipsecServerSummaryDtoSchema = z.object({
   natRuleManaged: z.boolean(),
   clientsTotal: z.number().int().nonnegative(),
   clientsOnline: z.number().int().nonnegative(),
+  /** Все сертификаты роутера (managed + существующие). */
   certs: z.array(ipsecCertInfoDtoSchema).optional(),
 })
 
+export const ipsecPeerPatchSchema = z.object({
+  name: z.string().min(1).max(64).optional(),
+  address: z.string().optional(),
+  exchangeMode: z.string().optional(),
+  passive: z.boolean().optional(),
+  certificate: z.string().optional(),
+  profile: z.string().optional(),
+  disabled: z.boolean().optional(),
+})
+
+export const ipsecCertDeleteRequestSchema = z.object({
+  name: z.string().min(1),
+})
+
 export const ipsecListResponseSchema = z.object({
   servers: z.array(ipsecServerSummaryDtoSchema),
   clients: z.array(ipsecClientDtoSchema),
@@ -131,6 +149,8 @@ export const ipsecUserCreateRequestSchema = z.object({
   serverId: z.union([z.string(), z.number()]),
   /** Отображаемое имя клиента; из него slug для серта/CN. */
   name: z.string().min(1).max(64),
+  /** Peer (сервер), к которому привязать identity; без — primary managed peer выбранного сервера. */
+  peerName: z.string().optional(),
   authMethod: ipsecAuthMethodSchema.default("certificate"),
   psk: z.string().min(8).optional(),
   remoteId: z.string().optional(),
@@ -178,6 +198,8 @@ export const ipsecUserCreatedSchema = z.object({
 export type IpsecAuthMethod = z.infer<typeof ipsecAuthMethodSchema>
 export type IpsecClientDto = z.infer<typeof ipsecClientDtoSchema>
 export type IpsecPeerDto = z.infer<typeof ipsecPeerDtoSchema>
+export type IpsecPeerPatch = z.infer<typeof ipsecPeerPatchSchema>
+export type IpsecCertDeleteRequest = z.infer<typeof ipsecCertDeleteRequestSchema>
 export type IpsecModeConfigDto = z.infer<typeof ipsecModeConfigDtoSchema>
 export type IpsecPoolDto = z.infer<typeof ipsecPoolDtoSchema>
 export type IpsecCertInfoDto = z.infer<typeof ipsecCertInfoDtoSchema>