v5.11.3: UX cleanup patch — manage --yes, backup ms-suffix, ICMP+oper FAQ, --psk highlight

[bivlked]

Summary

UX cleanup patch over v5.11.2 — interactive-command cleanups for cron/Ansible, rapid-backup collision protection, and FAQ extensions answering recent issues/discussions. No architectural changes.

What's in

Code

• manage --yes flag + AWG_YES=1 env — skips confirm prompts in remove, restore, restart. Opt-in; default behavior unchanged.
• Backup filename ms-suffix (awg_backup_2026-04-28_15-53-50.123.tar.gz) — collision protection on rapid-fire backups (regen → backup → modify → backup within the same second). Backwards-compatible: legacy backups still match the find pattern.

Docs (RU+EN)

• ADVANCED FAQ: ICMP в туннеле — based on D#63 (@PavelVVrn). Explicitly warns that ufw allow ... proto icmp is unsupported.
• oper→I1 table extended — Tele2 (Krasnoyarsk) updated with I1=absent workaround, new Megafon (regions) row, AWG 1.0 fallback explainer (I#42 @alkorrnd).
• README --psk highlight — new Cheat Sheet line + Shadowrocket FAQ entry (I#62 @andreykorobko).

Tests

• +34 bats (295 total, was 261):
  • test_yes_flag.bats (+11) — CLI_YES/AWG_YES branches isolated, non-"1" values explicitly rejected under forced-interactive mode.
  • test_backup_collision.bats (+8) — rapid-fire date +%3N distinct values, find/sort works on legacy + ms-suffix mix.
  • test_v5113_docs.bats (+15) — Phase 3+4+5 docs invariants, RU/EN cross-link drift guard.

Pre-merge checks

• ✅ 295/295 bats PASS (+34 from baseline 261)
• ✅ 0 shellcheck warnings (all 6 scripts)
• ✅ bash -n clean
• ✅ SCRIPT_VERSION 5.11.3 in 4 files, dates 2026-04-28 in 6 files
• ✅ COMMON/MANAGE_SCRIPT_SHA256 pins refreshed, match sha256sum of helper scripts
• ✅ External review caught 1 MEDIUM (README PSK doc — "$(awg genpsk) on both sides" generates two different keys) + 3 LOW (CHANGELOG wording omits restore, AWG_YES rejection test was masked by non-TTY guard, RU/EN link drift guard too lax). All four addressed in amend.
• ✅ VPS test on Ubuntu 24.04.4 LTS — 10/10 manage scenarios PASS (clean install with 2 reboots, manage add --psk produced matching PSK on both sides, rapid backup gave .856/.926 ms-suffix files, --yes/AWG_YES skip confirm, restore round-trip from ms-suffix backup with auto-rollback snapshot, legacy + ms-suffix backups coexist).

Test plan

• bats tests/ — 295 PASS
• shellcheck -s bash -S warning — 0 warnings on all 6 scripts
• VPS install + 2 reboots on clean Ubuntu 24.04 — completed step 99 cleanly
• manage add testclient --psk — PresharedKey present and matches between client .conf and server awg0.conf
• manage backup × 2 within same second — two distinct ms-suffix tar files
• manage remove ... --yes </dev/null — works without TTY
• AWG_YES=1 manage remove ... — env equivalent works
• manage restore <ms-suffix.tar.gz> — round-trip OK, auto-rollback snapshot created
• manage check — Состояние OK, AWG 2.0 параметры активны

Backwards compatibility

Fully backwards-compatible. --yes is opt-in (no behavior change without it). Backup ms-suffix coexists with legacy filenames; restore handles both. Downgrade to v5.11.2 is safe.