fix and update

install.sh

@@ -3005,6 +3005,85 @@ verify_sso_idp_api_burst() {
   return 1
 }
 
+# FedCM: discover.json на API-домене и /.well-known/web-identity на eTLD+1 (корневой домен).
+verify_fedcm_endpoints() {
+  load_env
+  local api_domain frontend_domain apex_domain ssl_type code body scheme curl_extra
+  api_domain="$(env_get DOMAIN_API "")"
+  frontend_domain="$(env_get DOMAIN_FRONTEND "")"
+  [[ -n "$api_domain" ]] || return 0
+
+  ssl_type="$(env_get SSL_TYPE none)"
+  scheme="http"
+  curl_extra=""
+  if [[ "$(env_get USE_NGINX_SSL false)" == "true" || "$ssl_type" != "none" ]]; then
+    scheme="https"
+    curl_extra="-k"
+  fi
+
+  code="$(curl ${curl_extra} -fsS --max-time 8 -o /dev/null -w '%{http_code}' "${scheme}://${api_domain}/fedcm/discover.json" 2>/dev/null || echo 000)"
+  if [[ "$code" == "200" ]]; then
+    echo -e "  ${GREEN}✔${NC} FedCM discover.json → 200 (${api_domain})"
+  elif [[ "$code" == "502" ]]; then
+    echo -e "  ${RED}✘${NC} FedCM discover.json → 502 (${api_domain}) — Nginx не проксирует /fedcm на api-gateway"
+    return 1
+  else
+    echo -e "  ${YELLOW}!${NC} FedCM discover.json → HTTP ${code} (${api_domain}, ожидалось 200)"
+  fi
+
+  apex_domain="$(registrable_domain "${frontend_domain:-$api_domain}")"
+  if [[ -z "$apex_domain" \
+        || "$apex_domain" == "$frontend_domain" \
+        || "$apex_domain" == "$api_domain" \
+        || "$apex_domain" == "${DOMAIN_DOCS:-}" ]]; then
+    return 0
+  fi
+
+  code="$(curl ${curl_extra} -fsS --max-time 8 -o /dev/null -w '%{http_code}' "${scheme}://${apex_domain}/.well-known/web-identity" 2>/dev/null || echo 000)"
+  body="$(curl ${curl_extra} -fsS --max-time 8 "${scheme}://${apex_domain}/.well-known/web-identity" 2>/dev/null || true)"
+  if [[ "$code" == "200" && "$body" == *provider_urls* ]]; then
+    echo -e "  ${GREEN}✔${NC} FedCM web-identity → 200 (${apex_domain})"
+    return 0
+  elif [[ "$code" == "000" ]]; then
+    echo -e "  ${RED}✘${NC} FedCM web-identity недоступен (${apex_domain}) — ERR_CERT или DNS"
+    echo "      Добавьте ${apex_domain} в hosts/DNS и примите сертификат (FedCM всегда запрашивает eTLD+1)."
+    return 1
+  elif [[ "$code" == "502" ]]; then
+    echo -e "  ${RED}✘${NC} FedCM web-identity → 502 (${apex_domain}) — проверьте nginx/conf.d/${NGINX_PREFIX}-fedcm-apex.conf"
+    return 1
+  else
+    echo -e "  ${YELLOW}!${NC} FedCM web-identity → HTTP ${code} (${apex_domain}, ожидалось 200 с provider_urls)"
+    return 1
+  fi
+}
+
+validate_ssl_cert_covers_apex() {
+  load_env
+  local apex_domain cert ssl_type sans
+  apex_domain="$(registrable_domain "${DOMAIN_FRONTEND:-$DOMAIN_API}")"
+  [[ -n "$apex_domain" ]] || return 0
+  if [[ "$apex_domain" == "${DOMAIN_FRONTEND:-}" || "$apex_domain" == "${DOMAIN_API:-}" ]]; then
+    return 0
+  fi
+
+  ssl_type="$(env_get SSL_TYPE none)"
+  case "$ssl_type" in
+    selfsigned) cert="${LOCAL_CERTS_DIR}/shared-intranet/fullchain.pem" ;;
+    custom) cert="${CUSTOM_CERT_TARGET_DIR}/fullchain.pem" ;;
+    *) return 0 ;;
+  esac
+
+  [[ -f "$cert" ]] || return 0
+  sans="$(openssl x509 -in "$cert" -noout -ext subjectAltName 2>/dev/null || true)"
+  if [[ "$sans" == *"${apex_domain}"* ]]; then
+    return 0
+  fi
+
+  warn "Сертификат не содержит SAN для ${apex_domain} — FedCM выдаст ERR_CERT_COMMON_NAME_INVALID"
+  warn "Пересоздайте сертификат: ./install.sh --fix-all (selfsigned) или добавьте ${apex_domain} в custom fullchain.pem"
+  return 1
+}
+
 write_all_nginx_configs() {
   ensure_nginx_mode_for_config_write
   local ssl_type="${1:-$(env_get SSL_TYPE none)}"
@@ -3939,6 +4018,8 @@ action_fix_all_errors() {
   check_sso_idp_api_proxy || fail "SSO /idp-api/health недоступен — см. nginx/conf.d/${NGINX_PREFIX}-frontend.conf"
   check_sso_frontend_root || fail "SSO / → 502 — главная страница недоступна (502 Bad Gateway в браузере)"
   verify_sso_idp_api_burst || warn "Нестабильный /idp-api/health — при 502 в браузере: docker compose --profile proxy exec nginx nginx -s reload"
+  validate_ssl_cert_covers_apex || true
+  verify_fedcm_endpoints || warn "FedCM endpoints недоступны — см. DNS/SSL для eTLD+1 и nginx/conf.d/${NGINX_PREFIX}-fedcm-apex.conf"
   if ! docker_nginx_container_running; then
     fail "Контейнер lendry-id-nginx не запущен. Проверьте: docker compose --profile proxy logs nginx"
   fi