fix: self-test TLS pin on self-signed, DB recovery blank-boot, egress wording

Three bugs found reviewing this session's commits, all self-inflicted:

- Self-test did full TLS verification because SelfTest read settings straight
  from the store and never populated TLSPinSHA256 — so on a self-signed / not-
  yet-CA-trusted cert it failed the handshake and reported a working server as
  broken, exactly on the fresh/IP installs where the check matters most. Mirror
  server.applyTLSHints: pin the cert when it isn't CA-trusted.
- DB auto-recovery quarantined the corrupt file before restoring; a failed
  restore left rospanel.db absent, so the next boot read the missing file as a
  fresh install and came up blank with admin/admin, masking the corruption.
  Move the quarantined file back when restore leaves no DB, so the next boot
  re-detects and re-alerts.
- describeExit claimed "прямой выход" when the server's own IP couldn't be
  resolved; report plain success instead of asserting an egress it can't verify.

Author: AppsGanin

cmd/rospanel/dbrecover.go

@@ -59,6 +59,13 @@ func ensureHealthyDB(dbPath, dataDir string) error {
 
 	newest := filepath.Join(dataDir, backup.LocalBackupDir, archives[0])
 	if rerr := backup.Restore(newest, dataDir); rerr != nil {
+		// Restore may have written nothing, leaving dbPath absent. If we returned now,
+		// the next boot's store.Check would read the missing file as a fresh install
+		// and start blank with admin/admin — silently masking the corruption. Move the
+		// quarantined file back so the next boot re-detects the damage and re-alerts.
+		if _, statErr := os.Stat(dbPath); os.IsNotExist(statErr) {
+			_ = os.Rename(quarantine, dbPath)
+		}
 		return fmt.Errorf("database is corrupt and restoring %s failed: %w "+
 			"(the damaged database is preserved at %s)", archives[0], rerr, quarantine)
 	}

internal/core/manager_selftest.go

@@ -20,6 +20,16 @@ func (m *Manager) SelfTest(ctx context.Context) ([]selftest.Result, error) {
 	if err != nil {
 		return nil, err
 	}
+	// Populate the same per-request TLS hints the subscription path fills in (see
+	// server.applyTLSHints): on a self-signed / not-yet-CA-trusted cert, real links
+	// carry the cert pin (pcs → pinnedPeerCertSha256) so clients trust it. Without
+	// this the probe would do full verification and fail the TLS handshake on a
+	// self-signed fallback — reporting a working server as broken, exactly on the
+	// fresh/IP installs where the self-test matters most.
+	if !m.HasValidCert() {
+		set.TLSInsecure = true
+		set.TLSPinSHA256 = m.CertPinSHA256()
+	}
 	if !m.sup.Running() {
 		return []selftest.Result{{OK: false,
 			Detail: "Xray не запущен — сначала устраните ошибку в разделе диагностики"}}, nil

internal/selftest/selftest.go

@@ -153,7 +153,11 @@ func describeExit(exitIP, serverIP string) string {
 	switch {
 	case exitIP == "":
 		return "трафик проходит"
-	case serverIP != "" && exitIP != serverIP:
+	case serverIP == "":
+		// Couldn't establish the server's own IP, so we can't tell a direct exit from
+		// a lane — report success without claiming either.
+		return "трафик проходит"
+	case exitIP != serverIP:
 		return "трафик проходит, выход через " + exitIP +
 			" — не прямой адрес сервера (полоса WARP/Opera, прокси или второй IP)"
 	default: