[client, proxy] IPv6 in-place apply + accept-loop hardening on netstack listeners

Two related fixes for the embedded netbird client and the per-account
inbound listeners that ride on its gVisor netstack.

client/internal/engine.go — replace hasIPv6Changed with reconcileIPv6:

  - First v6 assignment (current had no v6, conf carries one) is applied
    in place via WGIface.UpdateAddr instead of returning ErrResetConnection.
    Pre-fix, every embedded client whose account had IPv6 enabled would
    reset on its first NetworkMap sync — boot config has no v6, the sync
    introduces one, the engine tore itself down to "apply" it. That
    teardown destroys the gVisor netstack and orphans every listener
    bound on it, which is what made the proxy's per-account :80/:443
    silently stop accepting traffic.
  - v6 removed clears in place.
  - v6 swapped to a different non-empty value still resets (gVisor
    netstack can't safely swap its address at runtime).
  - Mutates e.config.WgAddr to match the applied state so subsequent
    PeerConfig comparisons are stable.

proxy/internal/tcp/accept.go (new) + proxy/inbound.go +
proxy/internal/tcp/router.go — harden the two Accept() loops on
netstack-backed listeners:

  - IsClosedListenerErr recognises net.ErrClosed AND gVisor's
    "endpoint is in invalid state" — the latter survives gonet's
    *net.OpError wrapping in a way errors.Is(.., net.ErrClosed) does
    not. Without this the loop spins CPU-hot after the underlying
    netstack is destroyed (peer rekey, embedded-client reset, account
    churn), emitting one log line per iteration.
  - AcceptBackoff implements the exponential backoff that
    net/http.Server.Serve uses on transient Accept errors: 5ms doubling
    up to 1s. Defence-in-depth so an unknown sticky error cannot burn
    a CPU core even if IsClosedListenerErr misses its signature.

proxy/internal/roundtrip/netbird.go — emit a single structured INFO
line summarising every embed.Options flag (account_id, service_id,
public_key, management_url, wg_port, block_inbound, block_lan_access,
disable_ipv6, no_userspace, presence of credentials) when each
per-account embedded client is created. Secrets reduced to a "present"
boolean — never logged verbatim. Diagnostic-only; no behavior change,
but it makes the "why is this embedded peer misbehaving" loop a single
log read instead of a code dive.

Tests (real listeners, scripted errors, no mocks of production code):
  - engine_reconcileipv6_test.go: 8 cases for every transition (first
    assignment, no change, removed, prefix-length changed, value
    changed, invalid bytes, UpdateAddr error) plus a updateConfig
    integration check that the fix actually fires on a v6-added
    PeerConfig.
  - accept_test.go: IsClosedListenerErr matrix + AcceptBackoff
    progression / cap / reset / cancel-during-wait / cancel-before-call.
  - router_test.go, inbound_test.go: scriptedAcceptListener +
    TestRouter_Serve_ExitsOnGVisorInvalidEndpoint and
    TestFeedRouterFromListener_ExitsOnGVisorInvalidEndpoint —
    regression guards that fail in 2 s if the loop ever spins.

client/internal/engine.go

@@ -64,7 +64,6 @@ import (
 	mgm "github.com/netbirdio/netbird/shared/management/client"
 	"github.com/netbirdio/netbird/shared/management/domain"
 	mgmProto "github.com/netbirdio/netbird/shared/management/proto"
-	"github.com/netbirdio/netbird/shared/netiputil"
 	auth "github.com/netbirdio/netbird/shared/relay/auth/hmac"
 	relayClient "github.com/netbirdio/netbird/shared/relay/client"
 	signal "github.com/netbirdio/netbird/shared/signal/client"
@@ -1078,11 +1077,17 @@ func (e *Engine) updateConfig(conf *mgmProto.PeerConfig) error {
 		return ErrResetConnection
 	}
 
-	if !e.config.DisableIPv6 && e.hasIPv6Changed(conf) {
-		log.Infof("peer IPv6 address changed, restarting client")
-		_ = CtxGetState(e.ctx).Wrap(ErrResetConnection)
-		e.clientCancel()
-		return ErrResetConnection
+	if !e.config.DisableIPv6 {
+		reset, err := e.reconcileIPv6(conf)
+		if err != nil {
+			log.Warnf("reconcile IPv6 from PeerConfig: %v", err)
+		}
+		if reset {
+			log.Infof("peer IPv6 address changed value, restarting client")
+			_ = CtxGetState(e.ctx).Wrap(ErrResetConnection)
+			e.clientCancel()
+			return ErrResetConnection
+		}
 	}
 
 	if conf.GetSshConfig() != nil {
@@ -1104,25 +1109,58 @@ func (e *Engine) updateConfig(conf *mgmProto.PeerConfig) error {
 	return nil
 }
 
-// hasIPv6Changed reports whether the IPv6 overlay address in the peer config
-// differs from the configured address (added, removed, or changed).
-// Compares against e.config.WgAddr (not the interface address, which may have
-// been cleared by ClearIPv6 if OS assignment failed).
-func (e *Engine) hasIPv6Changed(conf *mgmProto.PeerConfig) bool {
-	current := e.config.WgAddr
+// reconcileIPv6 applies the management-supplied IPv6 overlay address to the
+// engine's WireGuard interface in place when possible. Three transitions:
+//
+//   - First v6 assignment (current had no v6, conf carries one): apply via
+//     WGIface.UpdateAddr, no reset. Critical for embedded clients whose
+//     boot config has no v6 — without this we reset on every fresh start
+//     once management has v6 enabled, orphaning any netstack listeners
+//     held outside the engine.
+//   - v6 removed (current had v6, conf carries none): clear in place, no
+//     reset.
+//   - v6 swapped to a different non-empty value: returns reset=true so the
+//     caller falls back to the engine-recreate path — the underlying
+//     interface address can't be safely swapped in place across all
+//     backends (gVisor netstack in particular fixes its address at
+//     CreateNetTUN time).
+//
+// Mutates e.config.WgAddr to match the applied state so subsequent
+// PeerConfig comparisons are stable.
+func (e *Engine) reconcileIPv6(conf *mgmProto.PeerConfig) (reset bool, err error) {
 	raw := conf.GetAddressV6()
+	current := e.config.WgAddr
 
 	if len(raw) == 0 {
-		return current.HasIPv6()
+		if !current.HasIPv6() {
+			return false, nil
+		}
+		current.ClearIPv6()
+		e.config.WgAddr = current
+		if err := e.wgInterface.UpdateAddr(current); err != nil {
+			return false, fmt.Errorf("clear ipv6 on wg interface: %w", err)
+		}
+		return false, nil
 	}
 
-	prefix, err := netiputil.DecodePrefix(raw)
-	if err != nil {
-		log.Errorf("decode v6 overlay address: %v", err)
-		return false
+	incoming := current
+	if err := incoming.SetIPv6FromCompact(raw); err != nil {
+		return false, fmt.Errorf("decode v6 overlay address: %w", err)
 	}
 
-	return !current.HasIPv6() || current.IPv6 != prefix.Addr() || current.IPv6Net != prefix.Masked()
+	if !current.HasIPv6() {
+		e.config.WgAddr = incoming
+		if err := e.wgInterface.UpdateAddr(incoming); err != nil {
+			return false, fmt.Errorf("apply ipv6 on wg interface: %w", err)
+		}
+		return false, nil
+	}
+
+	if current.IPv6 == incoming.IPv6 && current.IPv6Net == incoming.IPv6Net {
+		return false, nil
+	}
+
+	return true, nil
 }
 
 func (e *Engine) receiveJobEvents() {