[management] Refuse a proxy claiming a host another account's gateway pinned

The bootstrap check refused pinning onto a cluster another account runs,
but nothing held that decision afterwards: a proxy registration consulted
the proxies table alone, so the same host could be claimed by another
account a moment later, or a week later, and the pin it stranded was
immutable. Validating only at bootstrap meant the check was true when it
ran and not after.

Make the claim symmetric. IsClusterAddressAvailable now treats a gateway
pin as what it is — a claim on the host, served by whichever proxy
declares that address — and refuses a proxy from a different account,
since an account-scoped proxy never receives another account's mappings
and so cannot serve the pin it would displace. Both claims are checked in
one place so a caller cannot consult one and forget the other. An account
claiming the address its own gateway is pinned to is the documented
order, not a conflict: pin first, deploy the proxy after.

Shared (NetBird-operated) proxies register without an account and are
unaffected; an account-scoped proxy reaching for a shared cluster address
that accounts are pinned to was already refused by the proxy-row conflict
and now stays refused even if those rows are momentarily gone.

Whichever of the two lands first now wins and the second is refused,
which is what the bootstrap check could not do on its own. A genuinely
concurrent pair can still pass both checks — closing that needs an
invariant spanning the proxies and settings tables, not a wider read.

management/internals/modules/reverseproxy/proxy/manager/manager.go

@@ -26,6 +26,7 @@ type store interface {
 	GetProxyByAccountID(ctx context.Context, accountID string) (*proxy.Proxy, error)
 	CountProxiesByAccountID(ctx context.Context, accountID string) (int64, error)
 	IsClusterAddressConflicting(ctx context.Context, clusterAddress, accountID string) (bool, error)
+	HasGatewayPinnedByOtherAccount(ctx context.Context, host, accountID string) (bool, error)
 	DeleteAccountCluster(ctx context.Context, clusterAddress, accountID string) error
 }
 
@@ -169,12 +170,36 @@ func (m *Manager) CountAccountProxies(ctx context.Context, accountID string) (in
 	return m.store.CountProxiesByAccountID(ctx, accountID)
 }
 
+// IsClusterAddressAvailable reports whether the account may claim this cluster
+// address.
+//
+// Two kinds of claim make an address unavailable, and both are checked here so
+// that no caller can consult one and forget the other. A proxy row is the
+// obvious one. An agent network gateway pinned to the address by another
+// account is the second: that pin is immutable and is served by whichever
+// proxy declares the address, so letting a proxy from a different account take
+// it strands the pin — an account-scoped proxy never receives another
+// account's mappings. An account claiming an address its own gateway is pinned
+// to is the intended order, not a conflict: pin first, deploy the proxy after.
 func (m *Manager) IsClusterAddressAvailable(ctx context.Context, clusterAddress, accountID string) (bool, error) {
 	conflicting, err := m.store.IsClusterAddressConflicting(ctx, clusterAddress, accountID)
 	if err != nil {
 		return false, err
 	}
-	return !conflicting, nil
+	if conflicting {
+		return false, nil
+	}
+
+	pinned, err := m.store.HasGatewayPinnedByOtherAccount(ctx, clusterAddress, accountID)
+	if err != nil {
+		return false, err
+	}
+	if pinned {
+		log.WithContext(ctx).Infof("cluster address %s is pinned as another account's agent network gateway, refusing claim by account %s", clusterAddress, accountID)
+		return false, nil
+	}
+
+	return true, nil
 }
 
 func (m *Manager) DeleteAccountCluster(ctx context.Context, clusterAddress, accountID string) error {

management/internals/modules/reverseproxy/proxy/manager/manager_test.go

@@ -24,6 +24,7 @@ type mockStore struct {
 	getProxyByAccountIDFunc                  func(ctx context.Context, accountID string) (*proxy.Proxy, error)
 	countProxiesByAccountIDFunc              func(ctx context.Context, accountID string) (int64, error)
 	isClusterAddressConflictingFunc          func(ctx context.Context, clusterAddress, accountID string) (bool, error)
+	hasGatewayPinnedByOtherAccountFunc       func(ctx context.Context, host, accountID string) (bool, error)
 	deleteAccountClusterFunc                 func(ctx context.Context, clusterAddress, accountID string) error
 }
 
@@ -84,6 +85,12 @@ func (m *mockStore) IsClusterAddressConflicting(ctx context.Context, clusterAddr
 	}
 	return false, nil
 }
+func (m *mockStore) HasGatewayPinnedByOtherAccount(ctx context.Context, host, accountID string) (bool, error) {
+	if m.hasGatewayPinnedByOtherAccountFunc != nil {
+		return m.hasGatewayPinnedByOtherAccountFunc(ctx, host, accountID)
+	}
+	return false, nil
+}
 func (m *mockStore) DeleteAccountCluster(ctx context.Context, clusterAddress, accountID string) error {
 	if m.deleteAccountClusterFunc != nil {
 		return m.deleteAccountClusterFunc(ctx, clusterAddress, accountID)
@@ -338,3 +345,65 @@ func TestGetActiveClusterAddressesForAccount(t *testing.T) {
 	require.NoError(t, err)
 	assert.Equal(t, expected, result)
 }
+
+// TestIsClusterAddressAvailableConsidersGatewayPins pins that a proxy row is
+// not the only claim on an address.
+//
+// An agent network gateway pinned to the address by another account is
+// immutable and is served by whichever proxy declares that address, so a proxy
+// from a different account taking it strands the pin — the mapping paths never
+// hand an account-scoped proxy another account's mappings. Refusing the later
+// claimant is what makes the bootstrap-time ownership check hold over time
+// rather than only at the instant it runs: without this, an address a gateway
+// pinned while no proxy served it could be taken a moment, or a week, later.
+func TestIsClusterAddressAvailableConsidersGatewayPins(t *testing.T) {
+	ctx := context.Background()
+
+	tests := []struct {
+		name        string
+		conflicting bool
+		pinned      bool
+		available   bool
+	}{
+		{name: "free address", available: true},
+		{name: "claimed by a proxy", conflicting: true},
+		{name: "pinned by another account's gateway", pinned: true},
+		{name: "claimed both ways", conflicting: true, pinned: true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			st := &mockStore{
+				isClusterAddressConflictingFunc: func(context.Context, string, string) (bool, error) {
+					return tt.conflicting, nil
+				},
+				hasGatewayPinnedByOtherAccountFunc: func(context.Context, string, string) (bool, error) {
+					return tt.pinned, nil
+				},
+			}
+			m, err := NewManager(st, noop.NewMeterProvider().Meter(""))
+			require.NoError(t, err)
+
+			available, err := m.IsClusterAddressAvailable(ctx, "gw.example.com", "account1")
+			require.NoError(t, err)
+			assert.Equal(t, tt.available, available)
+		})
+	}
+}
+
+// TestIsClusterAddressAvailableSurfacesGatewayPinError pins that a failed pin
+// lookup refuses the claim rather than falling through to available: this runs
+// on the proxy-connect path, where "could not tell" must not read as "yes".
+func TestIsClusterAddressAvailableSurfacesGatewayPinError(t *testing.T) {
+	st := &mockStore{
+		hasGatewayPinnedByOtherAccountFunc: func(context.Context, string, string) (bool, error) {
+			return false, errors.New("db down")
+		},
+	}
+	m, err := NewManager(st, noop.NewMeterProvider().Meter(""))
+	require.NoError(t, err)
+
+	available, err := m.IsClusterAddressAvailable(context.Background(), "gw.example.com", "account1")
+	require.Error(t, err)
+	assert.False(t, available)
+}