tls auth-key passes verify in site-to-site mode, but the template emits tls-auth only for client and server modes.

Location
data/templates/openvpn/server.conf.j2:198-204

src/conf_mode/interfaces_openvpn.py:452-454, :478-479, :961-968

Problem
tls-auth emitted only for mode client/server; key file is written but unused; tls role never consulted.

Impact
Control-channel HMAC silently absent.

Suggested fix
Render tls-auth <file> <0|1> using tls role in site-to-site; or reject auth-key there.