fix(converge): reconcile Pangolin resources instead of add-only (#309)

[ChrisonSimtian]

Closes #309.

The Pangolin resource reconciler found-or-created by fullDomain and, if the resource already
existed, left it entirely alone — target included. Editing a declared target updated desired
state and never reached Pangolin.

That failed silently, which is the real defect. During #303 the Pulse UI moved from CT 4000 to
CT 4001 and stacks/Core was updated; converge reported 0 to create, 0 drifted, 3 up-to-date
while the live target still pointed at 10.10.0.40 — a container that had just been stopped.
pulse.lab.chrison.dev was down and converge said everything was fine.

Now

Drift	Call
target ip / port / method / enabled	POST /target/{targetId}
the ssl and sso gates	POST /resource/{resourceId}

siteId is required on the target update even when unchanged, or it 400s with
expected number, received undefined at "siteId" — as the issue found.

Verified live against CT 2013, end to end

1. No false positives — live in sync:

NOCHANGE: … 15 resource(s) declared, 0 created, 0 retargeted, 0 re-gated

2. Drift injected on traefik.lab's target via the API (8080 → 8081), then converge:

APPLIED: … 15 resource(s) declared, 0 created, 1 retargeted, 0 re-gated
  traefik.lab.chrison.dev: target http://localhost:8081 → http://localhost:8080

3. Restored and idempotent — traefik.lab.chrison.dev serves again (302 to Pangolin auth), and
a re-run returns to NOCHANGE.

Scoped with --only pangolin from #324, which is what made testing this against a live stack
reasonable at all.

Three implementation notes

One call covers the common case. GET /org/{org}/resources already embeds ssl, sso and the
targets, so a no-drift run still costs a single call. But that embedded form omits method, so
detail comes from GET /resource/{id}/targets — one extra call per declared-and-existing resource.
Comparing only the embedded fields would have left method drift undetectable, i.e. reproduced this
very bug in a narrower form.

Pangolin returns booleans inconsistently. ssl arrives as a JSON bool, sso as the integer
1. GetBoolean() throws on the latter, and treating a non-bool as false would have re-gated
all 15 resources on every single run. Both shapes are now read — there's a test pinning it.

Multi-target resources are reported and left alone. Pangolin supports several targets per
resource for load balancing; our shapes only ever declare one, and rewriting the first of several
would silently destroy a hand-built config — which the add-only guardrail in CLAUDE.md exists to
prevent.

Slightly beyond the ask

The issue is about the target; I also reconcile ssl/sso. Same silent-drift bug, and the
data was already fetched — a resource created before sso defaulted ON (#238), or flipped off by
hand in the UI, would otherwise stay publicly open forever. Reported as its own counter (re-gated)
so it's visible rather than folded into the target count.

Also: a read failure on the resource list now fails the member instead of reporting a clean run.
Reporting success when the API couldn't be read is the exact failure mode this issue is about.

Tests

11 new (174 total). In-sync writes nothing; ip/port/method/disabled drift each detected;
siteId present in the update payload; integer sso not mistaken for drift; sso: false honoured
without fighting it every run; live sso: 0 re-gated; multi-target left alone; zero-target gets one
added; unreachable API fails loudly.

Docs: ADR-0007's "add-only, idempotent by fullDomain" line and the matching comment in
stacks/Core/pangolin.lxc.yaml both corrected — they were describing the bug as the design.

Unblocks #314.