fix(ipsec): сохранять общий сертификат при удалении identity

tests/e2e/ipsec-delete.spec.ts

@@ -1,5 +1,45 @@
 import { test, expect } from "@playwright/test"
 
+for (const width of [1280, 320]) for (const shared of [false, true]) {
+  test(`IPsec: сохранить сертификат при удалении identity shared=${shared} ${width}px`, async ({ page }) => {
+    await page.setViewportSize({ width, height: 1000 })
+    const client = (n: number, serverId = "1") => ({ id: serverId + ":identity:*" + n, rosId: "identity:*" + n, serverId, serverName: "Роутер", name: "Клиент " + n, kind: "cert", certName: "shared-cert", authMethod: "certificate", online: false, disabled: false, managed: true })
+    let attempts = 0, deleted = false
+    await page.route("**/health", r => r.fulfill({ json: { ok: true } }))
+    await page.route("**/api/**", r => {
+      const url = new URL(r.request().url())
+      if (r.request().method() === "DELETE") {
+        attempts++
+        expect(decodeURIComponent(url.pathname)).toBe("/api/ipsec/users/1/identity:*0")
+        expect(url.searchParams.get("removeCertificate")).toBe("false")
+        if (attempts === 1) return r.fulfill({ status: 403, json: { error: "Нет доступа тест" } })
+        deleted = true
+        return r.fulfill({ json: { ok: true } })
+      }
+      const rows = [...(deleted ? [] : [client(0)]), client(1, shared ? "1" : "2")]
+      return r.fulfill({ json: url.pathname === "/api/ipsec" ? { servers: [{ serverId: "1", serverName: "Роутер", initialized: true, ike2Ready: true, natRuleManaged: false, clientsTotal: rows.filter(c => c.serverId === "1").length, clientsOnline: 0 }, { serverId: "2", serverName: "Другой", initialized: false, ike2Ready: false, natRuleManaged: false, clientsTotal: shared ? 0 : 1, clientsOnline: 0 }], clients: rows }
+        : url.pathname === "/api/servers" ? [1,2].map(id => ({ id, name: "Роутер " + id, host: "192.0.2." + id, enabled: true, type: "exit-node", country: "RU", status: "online" })) : url.pathname === "/api/auth/config" ? { required: false } : {} })
+    })
+    await page.goto("/ipsec?server=1")
+    const row = page.locator("tr[data-row-id]").filter({ has: page.getByRole("button", { name: "Клиент 0", exact: true, includeHidden: true }) })
+    await row.getByRole("button", { name: "Удалить клиента", exact: true }).click()
+    const dialog = page.getByRole("alertdialog"), checkbox = dialog.getByRole("checkbox", { name: "Удалить также клиентский сертификат" })
+    if (shared) { await expect(checkbox).not.toBeChecked(); await expect(checkbox).toBeDisabled(); await expect(dialog).toContainText("используется другими identity") }
+    else { await expect(checkbox).toBeChecked(); await expect(checkbox).toBeEnabled(); await checkbox.uncheck() }
+    await expect(dialog).toContainText("Сертификат останется на роутере")
+    expect(await dialog.evaluate(e => e.scrollWidth <= e.clientWidth)).toBe(true)
+    await dialog.getByRole("button", { name: "Удалить", exact: true }).click()
+    await expect(dialog.getByRole("alert")).toContainText("Нет доступа тест")
+    await expect(checkbox).not.toBeChecked()
+    await expect(row).toHaveCount(1)
+    await dialog.getByRole("button", { name: "Удалить", exact: true }).click()
+    await expect(dialog).toHaveCount(0)
+    await expect(row).toHaveCount(0)
+    expect(attempts).toBe(2)
+    if (shared) await expect(page.getByRole("button", { name: "Клиент 1", exact: true })).toBeVisible()
+  })
+}
+
 for (const kind of ["user", "server", "peer", "cert"] as const) {
   test(`IPsec: удаление ${kind} сохраняет подтверждение и защищает повтор`, async ({ page }) => {
     const peer = { id: "peer", rosId: "*P/1", serverId: "1", serverName: "Роутер", name: "peer-test", managed: true, disabled: false }