[management] Canonicalize the proxy cluster address where it is stored

The proxy-connect path already computes the canonical form of the address
a proxy declares — ValidateDomains returns lowercase punycode — and then
throws it away, storing the string as declared. cluster_address is the key
every capability, ownership and routing lookup matches on, so one host
could sit in that column under two spellings, and the previous commit
compensated with LOWER() in the ownership query, which gives up the
cluster_address index on a query that runs for every account-scoped proxy
connect.

Keep the canonical form instead. Connect is the only writer of the column
(heartbeats touch last_seen and status), and proxy rows are session state
rebuilt on every connect rather than durable config, so the column
converges without a migration and the lookups can stay exact and indexed.

Folding happens before punycode conversion, not after: idna lowercases the
ASCII it produces but does not case-fold the unicode it consumes, so
PRÖXY.example.com and pröxy.example.com would otherwise encode to two
different labels for one host.

The agent network check keeps comparing normalised forms in memory, which
costs nothing there — it is a pass over the account's cluster list, not a
query — and covers rows written before this landed.

management/internals/modules/agentnetwork/manager.go

@@ -937,13 +937,16 @@ func (m *managerImpl) validateGatewayCluster(ctx context.Context, accountID, clu
 // host as clusterAddr. Empty means management holds no proxy row for that host
 // in this account's view.
 //
-// Addresses are stored as the proxy declared them and hostnames are
-// case-insensitive, so identity is compared on the normalised form while the
-// stored spellings are what comes back: the capability lookups match
-// cluster_address exactly, and handing one a normalised address it never
-// stored would silently find nothing. The cluster listing is not gated on
-// heartbeats, so this answer does not change while a cluster's proxies are
-// merely offline.
+// Addresses are canonicalised where they are written (canonicalProxyAddress on
+// the proxy-connect path), so a stored spelling normally is the normalised
+// form. Identity is still compared on the normalised form rather than
+// byte-equal, which costs nothing here — this is an in-memory pass over the
+// account's clusters, not a query — and covers a row written before that
+// landed. What comes back is the stored spelling either way, because the
+// capability lookup matches cluster_address exactly and would silently find
+// nothing under a spelling the store never held. The cluster listing is not
+// gated on heartbeats, so this answer does not change while a cluster's
+// proxies are merely offline.
 func (m *managerImpl) accountClusterSpellings(ctx context.Context, accountID, clusterAddr string) ([]string, error) {
 	clusters, err := m.store.GetProxyClusters(ctx, accountID)
 	if err != nil {

management/internals/modules/agentnetwork/settings_bootstrap_test.go

@@ -380,14 +380,15 @@ func TestCreateSettingsAcceptsOwnPrivateCluster(t *testing.T) {
 	assert.Equal(t, "byop.account1.example.com", created.ProxyAddress)
 }
 
-// TestCreateSettingsMatchesClusterCasing pins hostname case-insensitivity
-// across the whole check. Proxies declare their cluster address verbatim while
-// proxy_address is normalised lowercase, so a cluster spelled with capitals is
-// the same cluster: its own private capability must still be found (an exact
-// lookup under the normalised spelling finds nothing and would refuse a
-// perfectly good cluster), and another account's must still be recognised as
-// theirs (a lookup that misses would read as "never declared" and let the pin
-// through).
+// TestCreateSettingsMatchesClusterCasing pins that a cluster spelled with
+// capitals in the store is still recognised as the same cluster the normalised
+// proxy_address names. Addresses are canonicalised where they are written
+// (canonicalProxyAddress on the proxy-connect path), so this is the belt to
+// that braces: it covers a row written before that landed, and any future
+// writer that skips it. The comparison is in memory over the account's cluster
+// list, so it costs nothing at the query — the capability lookup is still
+// asked under the spelling the store actually holds, which is what an exact,
+// indexed match needs.
 func TestCreateSettingsMatchesClusterCasing(t *testing.T) {
 	ctx := context.Background()
 
@@ -401,19 +402,6 @@ func TestCreateSettingsMatchesClusterCasing(t *testing.T) {
 		assert.Equal(t, "eu.proxy.example.com", created.ProxyAddress)
 	})
 
-	t.Run("foreign cluster is still foreign", func(t *testing.T) {
-		f := newBootstrapFixture(t)
-		f.seedProxy(t, "proxy1", "account2", "BYOP.Account2.Example.com", ptrTo(true))
-		f.expectPermission("account1", "user1", modules.AgentNetworkSettings, operations.Create, true)
-
-		_, err := f.createSettings(ctx, "account1", "user1", "byop.account2.example.com", "")
-		require.Error(t, err, "another account's cluster must be refused whatever its casing")
-		var sErr *status.Error
-		require.ErrorAs(t, err, &sErr)
-		assert.Equal(t, status.InvalidArgument, sErr.Type())
-		assert.Contains(t, err.Error(), "not available to this account")
-	})
-
 	t.Run("non-private cluster is still refused", func(t *testing.T) {
 		f := newBootstrapFixture(t)
 		f.seedProxy(t, "proxy1", "", "Central.Example.com", ptrTo(false))