fix(ipsec): исключить чужие сессии при сопоставлении CN

backend/src/services/ipsec-live.ts

@@ -304,7 +304,10 @@ export function mapClients(state: IpsecServerState): IpsecClientDto[] {
     const subject = routerOsCertificateDn(cert)
     const bySubject = subject && subjectCounts.get(subject) === 1 ? activeByRemote.get(subject) : undefined
     const uniqueCn = cn && cnCounts.get(cn) === 1
-    const active = (uniqueCn ? findActive(cn) : undefined) ?? bySubject
+    // A literal CN is not a typed remote-id. It may also resemble another
+    // certificate's complete DN, in which case the bare-CN alias is unsafe.
+    const byCommonName = uniqueCn && !subjectCounts.has(cn) ? activeByRemote.get(cn) : undefined
+    const active = bySubject ?? byCommonName
       ?? (identity?.["remote-id"] ? findActive(String(identity["remote-id"]).trim()) : undefined)
     out.push({
       id: `${server.id}:${identity ? "identity" : "cert"}:${String(identity?.[".id"] ?? cert[".id"] ?? certName)}`,