feat(marketplace): realise a node's tunnel on the route server

[v0l]

Increment 4b of the marketplace work (work/marketplace.md). 4a allocated a tunnel — addresses and a key written down, nothing configured anywhere. This makes the tunnel carry traffic.

What it does

• Pushes the node's peer to the route server through the existing TunnelRouter, on allocation and on the routine router poll.
• AllowedIPs = the node's inner addresses + exactly its assigned guest addresses. That is the anti-spoof boundary, not a routing hint: WireGuard drops an inbound packet whose source is not listed, so a node cannot source traffic as another node's customer. wg set peer allowed-ips replaces the list, so a released guest address stops being accepted on the next reconcile.
• Routes the guest prefixes down the interface and gives the route server an address on each point-to-point link. AllowedIPs decides which peer a packet already headed for the tunnel belongs to — it does not put the packet there, so without a route the guest's return traffic is dropped as unroutable.
• Reports drift as missing / changed / unclaimed. They mean different things: a peer that is gone was configured and vanished, a changed one is carrying the wrong anti-spoof list, and an unclaimed one is a key on an LNVPS interface that no allocation accounts for. Unclaimed peers are removed — wgln* is ours outright.

Why peers are pushed one at a time

update_tunnel recreates the interface on the Linux backend and takes every peer with it, so one node getting a guest address would cut every other node on the route server. TunnelRouter gained set_tunnel_peer / remove_tunnel_peer / sync_tunnel_addresses / sync_tunnel_routes (wg set peer — additive and idempotent). A Mikrotik refuses them rather than accepting a pool and silently configuring nothing.

Worth a reviewer's eye

• The reconcile never deletes what the kernel owns — the v6 link-local address and the /31 link route — or it would fight the kernel on every poll. Both address families are queried separately because ip route show is IPv4 only; a v6 guest prefix would otherwise look absent forever and be re-added on every sync.
• Allowed IPs are compared as a set, since wg reports them in its own order. Treating that as a difference would rewrite a working peer's security boundary every poll.
• Correctness does not depend on a job firing. The reconcile rides the existing router poll, so a peer wiped by a reboot or an address assigned since the last push is corrected without an admin acting. SyncNodeTunnel exists only for promptness.
• Reconcile refuses to create the interface — that is SyncTunnelPool's job, and doing it here would hide the fact that it never ran.
• The backing host stays disabled: a configured peer is not a proven path. The health gate arrives with the node-side data plane (4c).

Tests

LinuxSshRouter gained a #[cfg(test)] command hook — these run as root on somebody else's route server, so what is worth asserting is the exact command issued, which needs the transport replaced rather than mocked around. New tests cover the peer/address/route commands (including the kernel-owned entries being left alone and both families being queried), the plan builder (anti-spoof list, released addresses, deleted VMs, non-node tunnels), and the worker paths (realisation, drift repair in all three directions, refusing a missing interface, single-peer push and withdrawal, pool-less tunnel refused).

Whole workspace suite green; 100% function coverage on the new code.

[v0l]

Second commit: a node now takes one address, not a point-to-point link.

4a gave each node a /31 and put the route server's half of every link on the pool's interface — one address on wgln<id> per node, thousands of them on a /16 pool, re-parsed out of ip addr show on every reconcile. WireGuard is layer 3 and point-to-point: no ARP, no neighbour resolution, no on-link requirement, and the node needs no gateway of its own (ip route add default dev wg0 suffices). The /31 was spending two addresses to say what one says, and charging the route server per node for it.

• Node holds a /32 / /128; the route server holds one address per pool, carrying the block's own prefix so every node in it is on-link.
• Interface addressing goes from O(nodes) to exactly one per family, and usable capacity roughly doubles.
• Reserved addresses follow from holding the block on-link: its network address, the route server's address after it, and (IPv4) its broadcast address. A /24 places 253 nodes where it previously reported 128 links.
• Block validation now asks what a block can actually place instead of comparing prefixes — a /31 looks like it holds two nodes and holds none.
• gateway4/gateway6 keep their shape but derive from the pool's block, so every node on a pool is told the same gateway. Peers, AllowedIPs and the anti-spoof boundary are untouched.

Doing it now because no node holds a /31 in production yet; later it would be a re-addressing exercise on live machines.

Docs and the changelog note the response change (address4/address6 are now host prefixes, gateway* is pool-wide, capacity is counted in placeable addresses). Whole workspace suite green.