Stop the controller panicking on a tunnel v2 dial to an unknown service. Fixes #4442

- uses the nil-safe getApiSessionId() in loadServiceForName, matching loadServiceForId; the v2
  tunnel circuit handler never establishes an api session, so the lookup-failure branch
  dereferenced a nil apiSession and took the controller down on any unresolvable service name
- makes the default admin check log a read failure and return instead of panicking; the check is
  advisory and runs in a goroutine that can observe a datastore the shutdown path has closed,
  turning a controlled exit into exit 2
- adds godoc for checkEdgeInitialized covering the advisory contract and the remaining fatal case
- notes both in the changelog

CHANGELOG.md

@@ -794,6 +794,7 @@ Thanks to the community members who contributed to this release.
 
 * github.com/openziti/xweb/v3: [v3.0.4 -> v3.0.5](https://github.com/openziti/xweb/compare/v3.0.4...v3.0.5)
 * github.com/openziti/ziti/v2: [v2.0.0 -> v2.1.0](https://github.com/openziti/ziti/compare/v2.0.0...v2.1.0)
+    * [Issue #4442](https://github.com/openziti/ziti/issues/4442) - Controller panics on tunnel v2 dial to an unknown service and on the default admin check when the db is not open
     * [Issue #4378](https://github.com/openziti/ziti/issues/4378) - Api session enforcer delete meter only marks when the batch delete fails
     * [Issue #4434](https://github.com/openziti/ziti/issues/4434) - Update to Go 1.27
     * [Issue #4413](https://github.com/openziti/ziti/issues/4413) - debian controller & router packages hang on post-install script when installed via ansible

controller/handler_edge_ctrl/common_tunnel.go

@@ -219,7 +219,7 @@ func (self *baseTunnelRequestContext) loadServiceForName(name string) {
 			}
 
 			logrus.
-				WithField("apiSessionId", self.apiSession.Id).
+				WithField("apiSessionId", self.getApiSessionId()).
 				WithField("operation", self.handler.Label()).
 				WithField("router", self.sourceRouter.Name).
 				WithField("serviceName", name).

controller/server/controller.go

@@ -254,13 +254,17 @@ func (c *Controller) Run() {
 	}
 }
 
+// checkEdgeInitialized warns when no default admin exists, so that an uninitialized cluster member is
+// diagnosable. It is advisory and runs concurrently with the rest of startup: a read failure is logged
+// and the check abandoned. On a controller without raft, the absence of a default admin is fatal.
 func (c *Controller) checkEdgeInitialized() {
 	log := pfxlog.Logger()
 
 	admin, err := c.AppEnv.Managers.Identity.ReadDefaultAdmin()
 
 	if err != nil {
-		log.WithError(err).Panic("could not check if a default admin exists")
+		log.WithError(err).Error("could not check if a default admin exists")
+		return
 	}
 
 	if admin == nil {