fix: start/stop for ring-only forwards + group sync via ring topology

Three issues fixed:

1. Start/stop returned 404 for forwards owned by other nodes:
   findLinkByTriple only checked local SQLite store. Added
   findLinkFromTopology fallback — startForward/stopForward now look up
   ring topology entries when the local store doesn't have the link.

2. Group labels didn't sync through the ring:
   handleForwardsAssign only updated local SQLite, never the ring
   topology. Added State.UpdateTopologyGroup + Engine.UpdateTopologyGroup
   — handleForwardsAssign now updates both. Added topologySync callback
   called after every e.state = tk.State (OnToken) and e.state = s
   (AdoptState) to re-apply local store group overrides onto the freshly
   adopted topology, so they survive state adoption and propagate via
   the next token forward. handleForwardsGroupDelete also clears ring
   topology entries.

3. Status-merge branch omitted Group field:
   ring-only forwards always showed '未分组'. Added Group: t.Link.Group
   to the topology-merge forwardStatus.

Verified: 4-node cluster, 5 forwards, group assigned on node-a
propagates to all nodes within one token cycle; stop from non-owning
node succeeds (HTTP 200) and worker stops on the owning node.

internal/httpapi/server.go

@@ -370,6 +370,7 @@ func (h *Handler) handleStatus(w http.ResponseWriter, r *http.Request) {
 			Local: t.Local.Name, Remote: t.Remote.Name, RemotePort: t.Link.RemotePort,
 			LocalOnly: false, Kind: "remote", OwnerID: t.OwnerID, Active: t.Active,
 			LocalIP: t.Local.IP, LocalPort: t.Local.Port, LocalProto: t.Local.Protocol,
+			Group: t.Link.Group,
 		})
 		seenFwd[k] = true
 	}