feat(cluster): 停用改为「标记」语义，让 disabled 真正随令牌环跨节点传播

承接用户提问「设计上停用不是本来就会跨节点传输吗」——核实结论：结构上确实
如此（TopoEntry.Link 是完整 store.Link，整个 State 随 token 每轮广播），但
实际路径断了。断点正是「撤销会删掉 topology 条目」：条目是 flag 的载体，
删了就无处传播，于是停用只能靠一次性 revoke 任务投递给 owner，**owner 当时
不在线就收不到**（实测 .60 记 disabled=1 / .106 记 0，就是这么来的）。

## 改为标记而非移除

撤销不再 RemoveTopology，而是 UpdateTopologyDisabled(true)，条目保留、
Link.Disabled=true、Active=false。Active 正是为此存在：OfflineReassign()
只处理 Active 条目，所以停用的转发在 owner 掉线时不会被重新排队。

- 新增 UpdateTopologyDisabled / TopologyDisabled（照 UpdateTopologyGroup 的桥）
- 新增 store.ReconcileLinkDisabled 作接收端：adoption 时把环上的 flag 落进
  本地 store；本节点没有该转发时补一条 disabled 占位行（否则日后在本节点被
  claim 会复活），enable 则不建行
- SetTopologySync 由单向（store→环）扩为双向：群组仍上行，disabled 下行
- AddTopology 的 Active 跟随 Link.Disabled（原本硬编码 true，认领一个停用
  转发就会复活它）
- 审计日志细分 forward.stop / forward.start，与 forward.remove 区分

## 语义变更带出的两个新问题（都已修）

1. **「启动」这条路断了**。条目保留 ⇒ SubmitTask 被去重挡下，而认领路径的
   duplicate-claim 防御又会丢弃「已有 owner」的任务 ⇒ 重启任务发不出去，owner
   永远收不到，转发**能停不能起**。
   修：新增 Task.Restart 这一独立任务类型 + SubmitRestart + Handler.RestartFn，
   显式绕过 duplicate-claim 防御并原地复活（不重复建条目、不重跑 claim 簿记）。
   SubmitTask 的守卫同时从 HasTask 收窄为新的 HasActiveTask（跳过 disabled 条目
   与撤销任务）；saveCanvas 的判断相应改用 HasActiveTask，避免每次保存都对
   已标记的转发重复发撤销。

2. 原本两处 RemoveTopologyEntry 调用（ClaimFn/RevokeFn 的 disabled 分支）在
   新语义下会把本该保留的条目删掉，改为 UpdateTopologyDisabled。

## 测试（每个都做了「回退修复行→必须变红→还原变绿」双向验证）

- TestStoppedTopologyEntrySurvivesAdoption —— 离线成员也能学到停用，
  一次性 revoke 任务永远做不到这一点
- TestStoppedForwardNotRequeuedOnNodeDeparture / TestAddTopologyRespectsDisabledFlag
  —— 标记而非删除为何安全
- TestSubmitTaskNotBlockedByStoppedEntry / TestSubmitTaskStillDedupesActiveForward
- TestRestartTaskBypassesDuplicateClaimGuard / TestRestartFlagSurvivesTokenSerialization
- TestStopThenStartPublishesRestartTask（HTTP 端到端，断言**任务真的发出**）
- TestReconcileLinkDisabled*（store 侧三条）

★ 两次踩到**假绿**：第一版只断言 store 层（newTestHandler 的 Ring 为 nil，
坏掉的路根本没执行）；第二版在 re-enable **之后**才调 SubmitTask，此时新旧
谓词结果相同，测不出差异。都是靠「回退修复行看是否变红」抓出来的 —— 这个
双向验证已经是本项目的固定动作。

go build / go vet / go test ./... 全绿，gofmt 干净。

internal/store/store.go

@@ -663,6 +663,11 @@ func (s *Store) ReplaceLinks(links []Link) error {
 // SetLinkDisabled flips the disabled flag of a forward identified by its
 // (local, remote, remotePort) natural key. This is the persistence half of the
 // forwards-page start/stop toggle; the caller also drives the worker/ring side.
+//
+// Kept as a targeted UPDATE rather than a ReplaceLinks rewrite on purpose:
+// ReplaceLinks deletes and reinserts every row, handing out fresh autoincrement
+// ids and invalidating any Link a caller captured earlier (they travel inside
+// ring tokens). Flipping one flag must not perturb other rows' identity.
 func (s *Store) SetLinkDisabled(local, remote string, port int, disabled bool) error {
 	_, err := s.db.Exec(
 		"UPDATE links SET disabled = ? WHERE local = ? AND remote = ? AND remote_port = ?",
@@ -671,6 +676,52 @@ func (s *Store) SetLinkDisabled(local, remote string, port int, disabled bool) e
 	return err
 }
 
+// ReconcileLinkDisabled applies a cluster-wide view of one forward's disabled
+// flag into the local store, creating a placeholder row when this node has none
+// yet.
+//
+// This is the receive half of disabled-flag propagation. The stop decision is
+// made on whichever node served the request, then rides the token ring in the
+// topology entry; every other member calls this on adoption so its own
+// links table agrees. Without it the flag lived only on the node that handled
+// the request, and the node actually OWNS the forward — usually a different
+// machine — still believed the forward was enabled and re-spawned its worker.
+//
+// A placeholder row is deliberate: a node that has never seen the forward still
+// needs to remember "this is stopped" so a later claim on this node cannot
+// resurrect it. The placeholder carries the same natural key, so a subsequent
+// real claim fills in the rest.
+func (s *Store) ReconcileLinkDisabled(local, remote string, port int, disabled bool) error {
+	cur, found, err := s.LinkByTriple(local, remote, port)
+	if err != nil {
+		return err
+	}
+	if found {
+		if cur.Disabled == disabled {
+			return nil // already agrees; avoid needless writes every token cycle
+		}
+		return s.SetLinkDisabled(local, remote, port, disabled)
+	}
+	if !disabled {
+		// Nothing to remember: an unknown forward with no entry is simply
+		// "not stopped", which is the default the claim path already assumes.
+		return nil
+	}
+	// Need a placeholder, which requires the local/remote foreign keys to exist.
+	if _, ok := s.GetLocal(local); !ok {
+		return nil // cannot materialise a link without its local peer row
+	}
+	if _, ok := s.GetRemote(remote); !ok {
+		return nil
+	}
+	links, err := s.ListLinks()
+	if err != nil {
+		return err
+	}
+	links = append(links, Link{Local: local, Remote: remote, RemotePort: port, Disabled: true})
+	return s.ReplaceLinks(links)
+}
+
 // SetLinkGroup assigns a management group label to a forward identified by its
 // (local, remote, remotePort) natural key. Empty string clears the group
 // (moves the forward to 未分组). This is the persistence half of the