fix: gate cross-node HTTP and stop-by-label on remote RBAC capability (#1509)

An older remote node ignores the forwarded actor-role header (running proxied
requests as admin) and ignores the stop-by-label stack allowlist (stopping
every label-matched stack). The control could neither detect nor prevent this
on a mixed-version fleet.

Instances now advertise a cross-node-rbac capability, and the control refuses
to act when a remote lacks it:

- HTTP proxy: a non-admin user's request is not forwarded to a remote that does
  not advertise the capability (fails closed when it cannot be determined).
  Admins are unaffected.
- Stop-by-label: a real stop bound to a confirmed stack set is not sent to a
  remote lacking the capability; the node is reported as needing an upgrade. As
  defense in depth, a node whose results name stacks outside the confirmed set
  is failed rather than rendered as a clean stop.

Separately, the stop's lock-contention path now reports every confirmed stack
as a contention failure (including one that lost its label), so a confirmed
stack is never silently dropped and the result is never empty.

backend/src/services/CapabilityRegistry.ts

@@ -41,8 +41,18 @@ export const CAPABILITIES = [
   'env-inventory',
   'project-env-files',
   'compose-storage',
+  'cross-node-rbac',
 ] as const;
 
+/**
+ * Advertised by instances that enforce the proxied actor's role (instead of
+ * treating every node-to-node request as admin) and honor the exact-stack
+ * allowlist on stop-by-label. The control instance refuses to forward a
+ * non-admin's request, or a confirmed stop, to a remote lacking this flag so a
+ * mixed-version fleet cannot escalate or over-stop on an un-upgraded node.
+ */
+export const CROSS_NODE_RBAC_CAPABILITY = 'cross-node-rbac';
+
 export type Capability = (typeof CAPABILITIES)[number];
 
 /** Returns true when the string is a usable semver version. */