fix(network): защитить ключи WireGuard и режим просмотра операций

app/(main)/firewall/page.tsx

@@ -2169,7 +2169,7 @@ function FirewallPageInner() {
 
   const scopedFailures = isLive ? failures.filter(f => (selectedServerId === ALL_SERVERS_ID || f.serverId === selectedServerId) && (!f.family || f.family === ipFamily)) : []
   const firewallIncomplete = scopedFailures.length > 0
-  const firewallWriteBlocked = firewallIncomplete || (isLive && !readTrusted)
+  const firewallWriteBlocked = (isLive && !can("mm:network:write")) || firewallIncomplete || (isLive && !readTrusted)
   const scopedSliceTimes = sliceTimes.filter(slice => (selectedServerId === ALL_SERVERS_ID || slice.serverId === selectedServerId) && slice.family === ipFamily)
   const freshness = firewallTimeRange(scopedSliceTimes)
   const totalEnabled = familyRules.filter((r) => r.enabled).length
@@ -2530,6 +2530,7 @@ function FirewallPageInner() {
       showAll
       allCount={displayServers.length}
       loading={isLive && dataLoading && displayServers.length === 0}
+      banner={isLive && !can("mm:network:write") ? <p role="status" className="border-b px-4 py-2 text-sm text-muted-foreground">Режим просмотра. Изменение конфигурации недоступно.</p> : undefined}
       header={
         <PageHeader
           crumbs={[{ label: "Управление" }, { label: "Firewall" }]}