Skip the check cycle for a Floating IP already occupied by another port

The cloud is live: the address list submitted as "free" (bootstrap config
or POST /api/v1/admin/ips) can drift by the time the orchestrator claims
it, or an operator can queue an already-occupied address by mistake.
Neutron's floating-IP association is a blind "last write wins" PUT with
no conflict error to catch, so associateFIP now checks the FIP's PortID
(already fetched via GetFloatingIPByAddress) before associating, guarded
against the false-positive of the FIP already belonging to this same
validator's own port.

A match routes the address straight to a new terminal ip_queue.state
("occupied", distinct from failed/fail) via db.MarkFIPOccupied — no
retries, since Neutron won't free it on its own and requeuing would let
it be reclaimed again next tick, starving the rest of the queue — plus a
dedicated fip_occupied audit event. Resubmitting the address later (once
the conflict is resolved) resets it to queued via the existing
POST /api/v1/admin/ips resubmit path (CancelIP/ListExpiredLeases updated
to treat occupied as terminal too). admin-dashboard gets its own "занят"
badge, distinct from fail/partial/cancelled.

Rebuilt bin/{control-api,admin-dashboard,prober,validator-agent} and
bin/SHA256SUMS per docs/SETUP.md's documented build recipe, since
control-api and admin-dashboard source changed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NeVbMVEiE7XQAkBd7HQgj6

internal/openstack/mock.go

@@ -35,6 +35,16 @@ func (m *MockClient) Seed(id, address, projectID string) {
 	m.byIP[address] = id
 }
 
+// SeedWithPort registers a floating IP as already associated to portID —
+// for simulating a FIP that's occupied (e.g. by another VM's port) before a
+// test's Tick runs.
+func (m *MockClient) SeedWithPort(id, address, projectID, portID string) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.fips[id] = &FloatingIP{ID: id, Address: address, ProjectID: projectID, PortID: portID}
+	m.byIP[address] = id
+}
+
 func (m *MockClient) GetFloatingIPByAddress(ctx context.Context, address string) (*FloatingIP, error) {
 	m.mu.Lock()
 	defer m.mu.Unlock()