fix: handle credential and console-managed route updates

[KKRainbow]

Summary

• keep duplicate non-reusable credential peers in OSPF sync while suppressing them from forwarding
• use topology reachability for OSPF sync and credential owner election, with forwarding reachability filtered at route lookup
• reconcile console-managed network config and cleanup legacy webhook instances

Tests

• cargo test -p easytier peer_ospf_route --lib
• cargo fmt --check

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.