Stealth sen:// port, random cert names, external Prometheus card

The subscription port answered every request with signed JSON: one probe
told a scanner what it had found, and the public key from any sen:// link
pinned the exact server. It now speaks the protocol only to those who prove
a secret — peek and register with the link's master secret, everything else
with a valid device signature — and gives Go's plain "404 page not found"
to the rest. A deleted device still gets its 410, but only when the request
is signed with its key, kept in the new revoked_devices table. The migration
freeze answers only proven clients too.

Self-signed certs for the subscription (SUB_TLS=on) and the node hub got
fixed names (sen, awg-node); new ones get a random host-like name. Clients
and nodes pin the key, so existing certs keep working.

The panel could already issue a metrics-only token, but nothing in the UI
used it. The Monitor tab gets an "External Prometheus" card: issue, reissue
and revoke the token, with a ready prometheus.yml fragment whose address is
taken from the page, so it carries the secret path or the nginx subfolder.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013bNGYiDst62wH3ZGTRPFLJ

install.sh

@@ -1389,13 +1389,16 @@ if [[ "$ROLE" != "node" ]]; then
         chmod 600 "$SUB_SIGN_PRIV"
         ok "Ключ подписи sen:// создан"
     fi
+    # Имя в сертификате случайное: одинаковое у всех серверов было бы сигнатурой для сканера.
+    # Клиент сверяет pin ключа, а не имя.
     if [[ "$SUB_TLS" == "on" ]]; then
         if [[ "$KEEP_DATA" == "y" && -f "$SUB_TLS_CRT" && -f "$SUB_TLS_KEY" ]]; then
             ok "Сертификат подписки sen:// сохранён"
         else
             ( umask 077
               openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -nodes \
-                  -keyout "$SUB_TLS_KEY" -out "$SUB_TLS_CRT" -days 3650 -subj "/CN=sen" 2>/dev/null )
+                  -keyout "$SUB_TLS_KEY" -out "$SUB_TLS_CRT" -days 3650 \
+                  -subj "/CN=$(rand_alnum 10 | tr 'A-Z' 'a-z').net" 2>/dev/null )
             chmod 600 "$SUB_TLS_KEY" "$SUB_TLS_CRT"
             ok "Самоподписанный сертификат подписки sen:// создан (10 лет)"
         fi