fix(fleet-sync): make control-identity-mismatch sticky and surface in UI (#1117)

Treat 409 CONTROL_IDENTITY_MISMATCH from a replica as a non-retriable
failure instead of looping the same 409 through the 5-minute retry
service forever and silently writing identical failure rows.

Backend
- DatabaseService: add `sticky_error_code`, `sticky_error_expected`,
  `sticky_error_got` columns to `fleet_sync_status` via an idempotent
  migration. New methods setFleetSyncSticky, getFleetSyncStickyCode,
  clearFleetSyncStickyForNode. recordFleetSyncSuccess clears the sticky
  flag on a clean push. getFailedSyncTargets SQL adds
  `AND sticky_error_code IS NULL` so the retry loop skips sticky rows.
- FleetSyncService.executePushToNode: short-circuits at the top when
  sticky is set (covers event-driven pushResourceAsync calls). On a 409
  with code CONTROL_IDENTITY_MISMATCH, records the failure once and
  pins sticky with the expected/got fingerprints carried in the 409 body.
- routes/nodes.ts: new POST /api/nodes/:id/fleet-sync/reset-anchor.
  Admin + paid + node:manage. Proxies POST /api/fleet/role/reanchor to
  the peer with `{override:true}` using the stored Bearer node_proxy
  token. On peer 200, clears every sticky row for the node so the next
  push re-anchors and resumes replication. Distinct 502 / 504 responses
  for peer-rejected / peer-unreachable so the UI can show a useful toast.

Frontend
- New lib/fleetSyncApi.ts + hooks/useFleetSyncStatus.ts. Polling hook
  (30s visibilityInterval) skips fetch when !isPaid.
- NodeManager.tsx: destructive banner per affected node listing both
  fingerprints, with `Reset anchor on peer` and `Remove node` buttons.
  Hidden for community-tier users via empty hook data.
- FleetConfiguration.tsx (Fleet -> Status): read-only `Policy sync`
  SummaryRow per remote node card. In sync / degraded / paused with
  a tooltip; no action buttons (the action lives in NodeManager).

Tests
- fleet-sync-service.test.ts: 4 new cases for sticky-set on first
  mismatch, short-circuit on subsequent pushes, null fingerprints,
  and non-mismatch failures not setting sticky.
- database-fleet-sync-sticky.test.ts (new): 6 cases pinning the DB
  contract incl. retry-loop SQL filter and migration idempotency.
- nodes-fleet-sync-reset-anchor.test.ts (new): 6 cases covering
  happy path, peer 401 -> 502, peer unreachable -> 504, local-node
  rejection, unknown node id, and community-tier 403.

Gate parity (Directive 30): the new POST .../reset-anchor enforces
requireAdmin + requirePaid + node:manage (matches the existing read at
GET /api/fleet/sync-status). UI banner + SummaryRow only render when the
hook returns data, which it only does for paid-tier authed users. No
existing tier-gate file moved; this is greenfield parity.

Auth audit: the peer's POST /api/fleet/role/reanchor route already uses
requireAdmin, which accepts the central's stored node_proxy Bearer
token because authMiddleware maps `scope === 'node_proxy'` to
`req.user = { username: 'node-proxy', role: 'admin', userId: 0 }`.
No widening required.

Backend tsc clean. Frontend tsc -b clean. 59 fleet-sync tests pass; full
backend suite green minus the pre-existing Windows-only file-lock flake
on filesystem-backup.test.ts that reproduces unchanged on main.

frontend/src/hooks/useFleetSyncStatus.ts

@@ -0,0 +1,45 @@
+import { useCallback, useEffect, useState } from 'react';
+import { useLicense } from '@/context/LicenseContext';
+import { visibilityInterval } from '@/lib/utils';
+import { fetchFleetSyncStatuses, type FleetSyncStatus } from '@/lib/fleetSyncApi';
+
+const REFRESH_INTERVAL_MS = 30_000;
+
+/**
+ * Polls `/api/fleet/sync-status` and exposes the rows plus a manual
+ * `refresh()`. Skips fetching for community-tier users since the endpoint is
+ * paid-tier-gated; the hook returns an empty array in that case so consumers
+ * can render the `!isPaid` branch without conditionals.
+ */
+export function useFleetSyncStatus(): {
+  statuses: FleetSyncStatus[];
+  loading: boolean;
+  refresh: () => void;
+} {
+  const { isPaid } = useLicense();
+  const [statuses, setStatuses] = useState<FleetSyncStatus[]>([]);
+  const [loading, setLoading] = useState(true);
+
+  const refresh = useCallback(() => {
+    if (!isPaid) {
+      setStatuses([]);
+      setLoading(false);
+      return;
+    }
+    fetchFleetSyncStatuses()
+      .then((rows) => setStatuses(rows))
+      .catch((err) => {
+        // Stale data stays visible to avoid flicker; log so the failure isn't completely silent.
+        console.warn('[FleetSync] sync-status fetch failed:', err);
+      })
+      .finally(() => setLoading(false));
+  }, [isPaid]);
+
+  useEffect(() => {
+    refresh();
+    if (!isPaid) return undefined;
+    return visibilityInterval(refresh, REFRESH_INTERVAL_MS);
+  }, [isPaid, refresh]);
+
+  return { statuses, loading, refresh };
+}