fix(dtlsdial): унифицировать генерацию self-signed сертификата

Добавляет dtlsdial.GenerateSelfSignedCert() как единственное место создания
self-signed сертификата. cmd/server теперь использует его вместо прямого импорта
selfsign; Dialer.Dial уже использовал ленивый путь certOnce, который внутри
зовёт ту же функцию.

cmd/server/main.go

@@ -16,9 +16,9 @@ import (
 	"github.com/samosvalishe/btp/internal/proxy/bondserver"
 	"github.com/samosvalishe/btp/internal/proxy/tcpfwdserver"
 	"github.com/samosvalishe/btp/internal/proxy/udpserver"
+	"github.com/samosvalishe/btp/internal/transport/dtlsdial"
 	"github.com/samosvalishe/btp/internal/wire/srtpmimicry"
 	"github.com/pion/dtls/v3"
-	"github.com/pion/dtls/v3/pkg/crypto/selfsign"
 )
 
 func main() {
@@ -66,7 +66,7 @@ func main() {
 		logger.Warnf("running without -wrap: any client reaching %s can relay to %s (no shared-key auth)", cfg.Proxy.Listen, cfg.Proxy.Connect)
 	}
 
-	certificate, genErr := selfsign.GenerateSelfSigned()
+	certificate, genErr := dtlsdial.GenerateSelfSignedCert()
 	if genErr != nil {
 		logger.Errorf("self-signed cert: %v", genErr)
 		os.Exit(1)

internal/transport/dtlsdial/dtlsdial.go

@@ -14,6 +14,13 @@ import (
 	"github.com/pion/dtls/v3/pkg/crypto/selfsign"
 )
 
+// GenerateSelfSignedCert returns a new self-signed TLS certificate for use
+// as the DTLS identity. It is a thin wrapper around selfsign.GenerateSelfSigned
+// and exists so both cmd/server and Dialer share one call-site.
+func GenerateSelfSignedCert() (tls.Certificate, error) {
+	return selfsign.GenerateSelfSigned()
+}
+
 // Dialer configures the DTLS client handshake.
 type Dialer struct {
 	// HandshakeTimeout caps the handshake context. Zero means no timeout.