Run per-validator OpenStack work in parallel so all validators start at once

The orchestrator claimed idle validators one by one and associated each
floating IP synchronously (~30 s per address), so 20 validators started
about 30 s apart. Aggregation/disassociation and lease reclaim were
sequential in the same way.

The slow OpenStack calls now run in one goroutine per address, guarded by
an in-flight set against duplicates. control-api runs Tick in Async mode
(Tick does not wait); tests keep the waiting mode.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

cmd/control-api/main.go

@@ -59,6 +59,7 @@ func run(configPath string, log *slog.Logger) error {
 	}
 
 	orch := orchestrator.New(database, osClient, cfg, log)
+	orch.Async = true // slow OpenStack calls run per address, Tick never waits for them
 	// Background jobs (the floating-IP scan) live as long as the process, not
 	// as long as the HTTP request or loop iteration that started them.
 	orch.SetContext(ctx)