fix(network): защитить ключи WireGuard и режим просмотра операций

docs/ux-ui/acceptance/wireguard208-fixed-result.json

@@ -0,0 +1,82 @@
+{
+  "date": "2026-10-13",
+  "block": "12.5.208",
+  "database": "mm_accept_166_1791896339709",
+  "baseline": false,
+  "cases": [
+    {
+      "role": "reader",
+      "flag": "",
+      "status": 200,
+      "privateKeyExposed": false,
+      "nativeRequestCount": 4
+    },
+    {
+      "role": "reader",
+      "flag": "?includePrivateKey=1",
+      "status": 403,
+      "privateKeyExposed": false,
+      "nativeRequestCount": 0
+    },
+    {
+      "role": "reader",
+      "flag": "?includePrivateKey=true",
+      "status": 403,
+      "privateKeyExposed": false,
+      "nativeRequestCount": 0
+    },
+    {
+      "role": "writer",
+      "flag": "",
+      "status": 200,
+      "privateKeyExposed": false,
+      "nativeRequestCount": 4
+    },
+    {
+      "role": "writer",
+      "flag": "?includePrivateKey=1",
+      "status": 200,
+      "privateKeyExposed": true,
+      "nativeRequestCount": 4
+    },
+    {
+      "role": "writer",
+      "flag": "?includePrivateKey=true",
+      "status": 200,
+      "privateKeyExposed": true,
+      "nativeRequestCount": 4
+    },
+    {
+      "role": "admin",
+      "flag": "",
+      "status": 200,
+      "privateKeyExposed": false,
+      "nativeRequestCount": 4
+    },
+    {
+      "role": "admin",
+      "flag": "?includePrivateKey=1",
+      "status": 200,
+      "privateKeyExposed": true,
+      "nativeRequestCount": 4
+    },
+    {
+      "role": "admin",
+      "flag": "?includePrivateKey=true",
+      "status": 200,
+      "privateKeyExposed": true,
+      "nativeRequestCount": 4
+    },
+    {
+      "name": "is_admin alone",
+      "status": 403,
+      "permissionRequired": true
+    },
+    {
+      "role": "unauthenticated",
+      "status": 401
+    }
+  ],
+  "scope": "Production compiled WireGuard GET/auth/mapper, own restricted PostgreSQL and local RouterOS HTTP fixture with nonempty synthetic private key; isolated signed JWT",
+  "passed": true
+}