fix(ipsec): учитывать уникальный DNS SAN в активных сессиях

docs/ux-ui/acceptance/browser-ipsec-san-2026-10-11.json

@@ -0,0 +1,27 @@
+{
+  "date": "2026-10-11",
+  "runtime": {
+    "backend": "ux-san121",
+    "frontend": "ux-bound116"
+  },
+  "nativeSessions": 2,
+  "linuxEncryptedPings3of3": true,
+  "cases": [
+    {
+      "width": 1280,
+      "oneClientOnline": true,
+      "noArbitraryVip": true,
+      "noAmbiguity": true,
+      "noOverflow": true
+    },
+    {
+      "width": 320,
+      "oneClientOnline": true,
+      "noArbitraryVip": true,
+      "noAmbiguity": true,
+      "noOverflow": true
+    }
+  ],
+  "pageErrors": [],
+  "applicationWrites": []
+}

docs/ux-ui/acceptance/ipsec-san-matching-2026-10-11.json

@@ -0,0 +1,142 @@
+{
+  "date": "2026-10-11",
+  "block": "12.5.121",
+  "runtime": {
+    "backend": "ux-san121",
+    "version": "1.0.0-test.san121",
+    "frontend": "ux-bound116",
+    "buildContext": "build-export118 plus ipsec-live.ts override",
+    "sourceSha256": "a7808992ff131be9a082d5acf23314c45142168f7e30d418310303a5ead7e2e3",
+    "compiledSha256": "1e1ce751181eff5b5814e33a0abd672ad5c2ac0b57733f914a530ffb82ec6181",
+    "hashesMatchLocal": true
+  },
+  "checks": {
+    "ipsecScripts": 8,
+    "stateChecks": 127,
+    "backendBuild": true,
+    "scopedEslint": true,
+    "liveUiCases": 2
+  },
+  "native": {
+    "date": "2026-10-11",
+    "block": "12.5.121",
+    "name": "mm-ipsec121-1791659780707",
+    "linux": [
+      {
+        "variant": "certificate-derived",
+        "initiated": true,
+        "vip": "198.18.121.248",
+        "ping3of3": true,
+        "native": [
+          {
+            "id": "CN=mm-ipsec121-1791659780707-client",
+            "state": "established",
+            "vip": "198.18.121.248"
+          }
+        ],
+        "catalog": {
+          "online": true,
+          "activeAddress": "198.18.121.248"
+        }
+      },
+      {
+        "variant": "fqdn-san",
+        "initiated": true,
+        "vip": "198.18.121.247",
+        "ping3of3": true,
+        "native": [
+          {
+            "id": "CN=mm-ipsec121-1791659780707-client",
+            "state": "established",
+            "vip": "198.18.121.248"
+          },
+          {
+            "id": "mm-ipsec121-1791659780707.example",
+            "state": "established",
+            "vip": "198.18.121.247"
+          }
+        ],
+        "catalog": {
+          "online": true
+        }
+      }
+    ],
+    "cleanup": [
+      {
+        "serverId": 1,
+        "/system/logging": true,
+        "/ip/ipsec/identity": true,
+        "/ip/ipsec/peer": true,
+        "/ip/ipsec/policy": true,
+        "/ip/ipsec/policy/group": true,
+        "/ip/ipsec/mode-config": true,
+        "/ip/ipsec/proposal": true,
+        "/ip/ipsec/profile": true,
+        "/certificate": true,
+        "/file": true,
+        "/ip/address": true,
+        "/ip/route": true,
+        "/ip/firewall/nat": true,
+        "/ip/pool": true,
+        "/interface/bridge": true,
+        "/ipv6/address": true
+      },
+      {
+        "serverId": 2,
+        "/system/logging": true,
+        "/ip/ipsec/identity": true,
+        "/ip/ipsec/peer": true,
+        "/ip/ipsec/policy": true,
+        "/ip/ipsec/policy/group": true,
+        "/ip/ipsec/mode-config": true,
+        "/ip/ipsec/proposal": true,
+        "/ip/ipsec/profile": true,
+        "/certificate": true,
+        "/file": true,
+        "/ip/address": true,
+        "/ip/route": true,
+        "/ip/firewall/nat": true,
+        "/ip/pool": true,
+        "/interface/bridge": true,
+        "/ipv6/address": true
+      }
+    ],
+    "clientImage": "sha256:c9d01c801de88b2349f685c1cb631e67a8b1c697439a00148d4045c23a584054",
+    "subject": {
+      "derHex": "302b3129302706035504030c206d6d2d69707365633132312d313739313635393738303730372d636c69656e74",
+      "attributes": [
+        {
+          "oidHex": "550403",
+          "stringTag": 12,
+          "value": "mm-ipsec121-1791659780707-client"
+        }
+      ],
+      "san": "X509v3 Subject Alternative Name: \n    DNS:mm-ipsec121-1791659780707.example"
+    },
+    "native": [
+      {
+        "id": "CN=mm-ipsec121-1791659780707-client",
+        "state": "established",
+        "vip": "198.18.121.248"
+      },
+      {
+        "id": "mm-ipsec121-1791659780707.example",
+        "state": "established",
+        "vip": "198.18.121.247"
+      }
+    ],
+    "catalog": {
+      "online": true
+    },
+    "dockerCleanup": true,
+    "credentialFilesRemoved": true
+  },
+  "browserEvidence": "browser-ipsec-san-2026-10-11.json",
+  "bounds": [
+    "Only literal DNS SAN for directly bound certificate and absent/auto remote-id; no wildcard/IP/email inference",
+    "Duplicate SAN or DN/CN shadow is not attributed; overlapping catalog claims report ambiguity",
+    "Multiple received IDs of one certificate confirm presence without arbitrary VIP/uptime",
+    "First helper used previous VIP regex; corrected helper succeeded after verified cleanup",
+    "One WAN/NAT, Linux namespaces only; no physical redundancy or full client OS/PKI coverage"
+  ]
+}