fix(network): защитить ключи WireGuard и режим просмотра операций

app/(main)/gre/page.tsx

@@ -257,7 +257,7 @@ function GrePageContent({ selectedServerId, selectedTunnelId, allTunnelsHref, on
 
 
   const historyServerId = selectedServerId === ALL_SERVERS_ID ? null : selectedServerId
-  const mutationsLocked = !isLive || mutateBusy || dataLoading || !hasLoaded || liveStale || historyRestoring
+  const mutationsLocked = !isLive || !can("mm:network:write") || mutateBusy || dataLoading || !hasLoaded || liveStale || historyRestoring
   function canManage(serverId: string) {
     return !mutationsLocked && !failedServerIds.includes(serverId) && liveServers.some(s => s.id === serverId && s.enabled)
   }
@@ -548,6 +548,7 @@ function GrePageContent({ selectedServerId, selectedTunnelId, allTunnelsHref, on
       showAll
       allCount={displayServers.length}
       loading={isLive && dataLoading && displayServers.length === 0}
+      banner={isLive && !can("mm:network:write") ? <p role="status" className="border-b px-4 py-2 text-sm text-muted-foreground">Режим просмотра. Изменение конфигурации недоступно.</p> : undefined}
       header={
         <PageHeader
           crumbs={[{ label: "Управление" }, { label: "GRE-туннели" }]}