feat(cluster): 停用改为「标记」语义，让 disabled 真正随令牌环跨节点传播

承接用户提问「设计上停用不是本来就会跨节点传输吗」——核实结论：结构上确实
如此（TopoEntry.Link 是完整 store.Link，整个 State 随 token 每轮广播），但
实际路径断了。断点正是「撤销会删掉 topology 条目」：条目是 flag 的载体，
删了就无处传播，于是停用只能靠一次性 revoke 任务投递给 owner，**owner 当时
不在线就收不到**（实测 .60 记 disabled=1 / .106 记 0，就是这么来的）。

## 改为标记而非移除

撤销不再 RemoveTopology，而是 UpdateTopologyDisabled(true)，条目保留、
Link.Disabled=true、Active=false。Active 正是为此存在：OfflineReassign()
只处理 Active 条目，所以停用的转发在 owner 掉线时不会被重新排队。

- 新增 UpdateTopologyDisabled / TopologyDisabled（照 UpdateTopologyGroup 的桥）
- 新增 store.ReconcileLinkDisabled 作接收端：adoption 时把环上的 flag 落进
  本地 store；本节点没有该转发时补一条 disabled 占位行（否则日后在本节点被
  claim 会复活），enable 则不建行
- SetTopologySync 由单向（store→环）扩为双向：群组仍上行，disabled 下行
- AddTopology 的 Active 跟随 Link.Disabled（原本硬编码 true，认领一个停用
  转发就会复活它）
- 审计日志细分 forward.stop / forward.start，与 forward.remove 区分

## 语义变更带出的两个新问题（都已修）

1. **「启动」这条路断了**。条目保留 ⇒ SubmitTask 被去重挡下，而认领路径的
   duplicate-claim 防御又会丢弃「已有 owner」的任务 ⇒ 重启任务发不出去，owner
   永远收不到，转发**能停不能起**。
   修：新增 Task.Restart 这一独立任务类型 + SubmitRestart + Handler.RestartFn，
   显式绕过 duplicate-claim 防御并原地复活（不重复建条目、不重跑 claim 簿记）。
   SubmitTask 的守卫同时从 HasTask 收窄为新的 HasActiveTask（跳过 disabled 条目
   与撤销任务）；saveCanvas 的判断相应改用 HasActiveTask，避免每次保存都对
   已标记的转发重复发撤销。

2. 原本两处 RemoveTopologyEntry 调用（ClaimFn/RevokeFn 的 disabled 分支）在
   新语义下会把本该保留的条目删掉，改为 UpdateTopologyDisabled。

## 测试（每个都做了「回退修复行→必须变红→还原变绿」双向验证）

- TestStoppedTopologyEntrySurvivesAdoption —— 离线成员也能学到停用，
  一次性 revoke 任务永远做不到这一点
- TestStoppedForwardNotRequeuedOnNodeDeparture / TestAddTopologyRespectsDisabledFlag
  —— 标记而非删除为何安全
- TestSubmitTaskNotBlockedByStoppedEntry / TestSubmitTaskStillDedupesActiveForward
- TestRestartTaskBypassesDuplicateClaimGuard / TestRestartFlagSurvivesTokenSerialization
- TestStopThenStartPublishesRestartTask（HTTP 端到端，断言**任务真的发出**）
- TestReconcileLinkDisabled*（store 侧三条）

★ 两次踩到**假绿**：第一版只断言 store 层（newTestHandler 的 Ring 为 nil，
坏掉的路根本没执行）；第二版在 re-enable **之后**才调 SubmitTask，此时新旧
谓词结果相同，测不出差异。都是靠「回退修复行看是否变红」抓出来的 —— 这个
双向验证已经是本项目的固定动作。

go build / go vet / go test ./... 全绿，gofmt 干净。

internal/store/link_test.go

@@ -196,3 +196,93 @@ func TestGetLinkByIDIsStaleAfterReplaceLinks(t *testing.T) {
 		t.Fatalf("natural key must stay reliable, got %+v found=%v", got, found)
 	}
 }
+
+// TestReconcileLinkDisabledLearnsPeerDecision is the store half of
+// cluster-wide stop propagation. A node that did NOT serve the stop request has
+// no reason to know about it, and its links table is node-local — so the flag
+// arrives via the ring and lands here. The case that matters is the OWNER of a
+// forward on a different machine: before this existed, that node's copy still
+// read "enabled", so it kept (or re-spawned) the worker for a forward the user
+// had explicitly stopped.
+func TestReconcileLinkDisabledLearnsPeerDecision(t *testing.T) {
+	st, err := New(filepath.Join(t.TempDir(), "test.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer st.Close()
+	seed(t, st, []string{"mc"}, "srv")
+	if err := st.ReplaceLinks([]Link{{Local: "mc", Remote: "srv", RemotePort: 25565, Group: "game"}}); err != nil {
+		t.Fatal(err)
+	}
+
+	// A peer's stop arrives.
+	if err := st.ReconcileLinkDisabled("mc", "srv", 25565, true); err != nil {
+		t.Fatal(err)
+	}
+	ln, found, err := st.LinkByTriple("mc", "srv", 25565)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !found {
+		t.Fatal("link disappeared during reconcile")
+	}
+	if !ln.Disabled {
+		t.Fatal("the peer's stop did not land in the local store")
+	}
+	if ln.Group != "game" {
+		t.Fatalf("reconcile must not clobber other fields, group=%q", ln.Group)
+	}
+
+	// A peer's re-enable arrives.
+	if err := st.ReconcileLinkDisabled("mc", "srv", 25565, false); err != nil {
+		t.Fatal(err)
+	}
+	if ln, _, _ := st.LinkByTriple("mc", "srv", 25565); ln.Disabled {
+		t.Fatal("the peer's re-enable did not land")
+	}
+}
+
+// TestReconcileLinkDisabledCreatesPlaceholderForUnknownForward: a node that has
+// never seen the forward still must remember that it is stopped, otherwise a
+// later claim on that node would resurrect it.
+func TestReconcileLinkDisabledCreatesPlaceholderForUnknownForward(t *testing.T) {
+	st, err := New(filepath.Join(t.TempDir(), "test.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer st.Close()
+	seed(t, st, []string{"ghost"}, "srv")
+
+	if err := st.ReconcileLinkDisabled("ghost", "srv", 9999, true); err != nil {
+		t.Fatal(err)
+	}
+	ln, found, err := st.LinkByTriple("ghost", "srv", 9999)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !found {
+		t.Fatal("a stopped-but-unknown forward must be remembered, or a later claim resurrects it")
+	}
+	if !ln.Disabled {
+		t.Fatal("placeholder is not marked disabled")
+	}
+}
+
+// TestReconcileLinkDisabledIgnoresEnableForUnknown: an enable for a forward this
+// node has never seen must NOT create a row. Creating one would invent forwards
+// out of ring state.
+func TestReconcileLinkDisabledIgnoresEnableForUnknown(t *testing.T) {
+	st, err := New(filepath.Join(t.TempDir(), "test.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer st.Close()
+	seed(t, st, []string{"other"}, "srv")
+
+	if err := st.ReconcileLinkDisabled("unknown", "srv", 1234, false); err != nil {
+		t.Fatal(err)
+	}
+	if _, found, _ := st.LinkByTriple("unknown", "srv", 1234); found {
+		t.Fatal("an enable for an unknown forward must not materialise a row")
+	}
+}

internal/store/store.go

@@ -663,6 +663,11 @@ func (s *Store) ReplaceLinks(links []Link) error {
 // SetLinkDisabled flips the disabled flag of a forward identified by its
 // (local, remote, remotePort) natural key. This is the persistence half of the
 // forwards-page start/stop toggle; the caller also drives the worker/ring side.
+//
+// Kept as a targeted UPDATE rather than a ReplaceLinks rewrite on purpose:
+// ReplaceLinks deletes and reinserts every row, handing out fresh autoincrement
+// ids and invalidating any Link a caller captured earlier (they travel inside
+// ring tokens). Flipping one flag must not perturb other rows' identity.
 func (s *Store) SetLinkDisabled(local, remote string, port int, disabled bool) error {
 	_, err := s.db.Exec(
 		"UPDATE links SET disabled = ? WHERE local = ? AND remote = ? AND remote_port = ?",
@@ -671,6 +676,52 @@ func (s *Store) SetLinkDisabled(local, remote string, port int, disabled bool) e
 	return err
 }
 
+// ReconcileLinkDisabled applies a cluster-wide view of one forward's disabled
+// flag into the local store, creating a placeholder row when this node has none
+// yet.
+//
+// This is the receive half of disabled-flag propagation. The stop decision is
+// made on whichever node served the request, then rides the token ring in the
+// topology entry; every other member calls this on adoption so its own
+// links table agrees. Without it the flag lived only on the node that handled
+// the request, and the node actually OWNS the forward — usually a different
+// machine — still believed the forward was enabled and re-spawned its worker.
+//
+// A placeholder row is deliberate: a node that has never seen the forward still
+// needs to remember "this is stopped" so a later claim on this node cannot
+// resurrect it. The placeholder carries the same natural key, so a subsequent
+// real claim fills in the rest.
+func (s *Store) ReconcileLinkDisabled(local, remote string, port int, disabled bool) error {
+	cur, found, err := s.LinkByTriple(local, remote, port)
+	if err != nil {
+		return err
+	}
+	if found {
+		if cur.Disabled == disabled {
+			return nil // already agrees; avoid needless writes every token cycle
+		}
+		return s.SetLinkDisabled(local, remote, port, disabled)
+	}
+	if !disabled {
+		// Nothing to remember: an unknown forward with no entry is simply
+		// "not stopped", which is the default the claim path already assumes.
+		return nil
+	}
+	// Need a placeholder, which requires the local/remote foreign keys to exist.
+	if _, ok := s.GetLocal(local); !ok {
+		return nil // cannot materialise a link without its local peer row
+	}
+	if _, ok := s.GetRemote(remote); !ok {
+		return nil
+	}
+	links, err := s.ListLinks()
+	if err != nil {
+		return err
+	}
+	links = append(links, Link{Local: local, Remote: remote, RemotePort: port, Disabled: true})
+	return s.ReplaceLinks(links)
+}
+
 // SetLinkGroup assigns a management group label to a forward identified by its
 // (local, remote, remotePort) natural key. Empty string clears the group
 // (moves the forward to 未分组). This is the persistence half of the