Retry a failed self-check on another validator; add the self-check failure ceiling

A validator that failed the self-check of an address no longer gets that address
again in the current round (ClaimNextQueued skips it); the validator itself stays
in service and takes all other addresses. The verdict fail is set when the number
of failed self-checks of an address reaches settings.self_check_max_attempts
(1..50, default 5, independent of the number of validators); max_retries and
retry_count are no longer used for self-check. If every working validator has
already failed the address, a new round starts and the exclusions lapse.

Migration 0012: ip_self_check_failures (permanent history per registry address),
ip_queue.sc_failures and sc_round_start_cycle (cycle_id is used instead of
attempt_number, which restarts when a queue row is recreated), the setting.
db.FailSelfCheck does it in one transaction; re-submission starts a new series.
API: self_check_max_attempts in GET/PUT /admin/config/orchestrator,
self_check_failed_on in /admin/ips/{ip} and /admin/registry/{ip}. Dashboard: the
field on /settings and the line "Self-check не прошёл на: ..." on the address
pages. Docs, plan and summary in docs/changes/.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/httpapi/handlers_admin.go

@@ -178,11 +178,23 @@ func (s *Server) handleAdminIPDetail(w http.ResponseWriter, r *http.Request) {
 		writeError(w, http.StatusInternalServerError, err.Error())
 		return
 	}
+	// Self-check failures of this address in its current run.
+	runID, err := s.DB.GetIPRunID(r.Context(), item.ID)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	failedOn, err := s.DB.ListSelfCheckFailedOn(r.Context(), item.RegistryID, runID)
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
 	writeJSON(w, http.StatusOK, struct {
-		IP     *db.IPQueueItem `json:"ip"`
-		Checks []db.Check      `json:"checks"`
-		Events []db.Event      `json:"events"`
-	}{item, checks, events})
+		IP                *db.IPQueueItem `json:"ip"`
+		Checks            []db.Check      `json:"checks"`
+		Events            []db.Event      `json:"events"`
+		SelfCheckFailedOn []string        `json:"self_check_failed_on"`
+	}{item, checks, events, failedOn})
 }
 
 func (s *Server) handleAdminValidators(w http.ResponseWriter, r *http.Request) {