traffic: audit endpoint + canonical app_key

selective-vpn-api/app/traffic_app_profiles.go

@@ -113,6 +113,7 @@ func upsertTrafficAppProfile(req TrafficAppProfileUpsertRequest) (TrafficAppProf
 			appKey = strings.TrimSpace(fields[0])
 		}
 	}
+	appKey = canonicalizeAppKey(appKey, cmd)
 	if appKey == "" {
 		return TrafficAppProfile{}, fmt.Errorf("cannot infer app_key")
 	}
@@ -284,6 +285,20 @@ func loadTrafficAppProfilesState() trafficAppProfilesState {
 	if st.Profiles == nil {
 		st.Profiles = nil
 	}
+
+	// EN: Best-effort migration: normalize app keys to canonical form.
+	// RU: Best-effort миграция: нормализуем app_key в канонический вид.
+	changed := false
+	for i := range st.Profiles {
+		canon := canonicalizeAppKey(st.Profiles[i].AppKey, st.Profiles[i].Command)
+		if canon != "" && strings.TrimSpace(st.Profiles[i].AppKey) != canon {
+			st.Profiles[i].AppKey = canon
+			changed = true
+		}
+	}
+	if changed {
+		_ = saveTrafficAppProfilesState(st)
+	}
 	return st
 }