fix(review): coderabbit follow-ups

- openapi.yml: declare default: false on ServiceTargetOptions.direct_upstream
  so generated clients/validators reflect the documented default.
- proto/proxy_service.proto: ValidateTunnelPeer doc + denied_reason list
  said "distribution_groups" (bearer-auth field) but the actual gate is
  service.access_groups. Replaced both occurrences to match the code path
  in checkPeerGroupAccess.
- peers/manager.go (GetPeerWithGroups) + users/manager.go (GetUserWithGroups):
  on store error after a successful first lookup, both now return
  (nil, nil, err) so callers can't get a valid entity alongside a non-nil
  error.

Findings skipped with reasons:
- embedded.go merged CLI/Dashboard redirect URIs: pre-existing on
  origin/main, not introduced by this PR.
- account_mock.go MarkPeerDisconnected zero-time UnixNano: same — pre-existing.
- openapi Service schema if/then conditionals: Go-side Validate() already
  enforces these invariants (Private + non-empty AccessGroups, mode=http,
  mutually-exclusive with bearer), and oapi-codegen on OpenAPI 3.1.x
  doesn't honour allOf/if/then anyway.
- *.patch / *.diff / b-n-p.sh: untracked personal artifacts, not part of
  any commit.

shared/management/http/api/openapi.yml

@@ -3213,7 +3213,8 @@ components:
             When true, the proxy dials this target via the host's network stack
             instead of through its embedded NetBird client. Use for upstreams
             reachable without WireGuard (public APIs, LAN services, localhost
-            sidecars). Default false.
+            sidecars).
+          default: false
           example: false
     ServiceTarget:
       type: object

shared/management/http/api/types.gen.go

@@ -4248,7 +4248,7 @@ type ServiceTargetOptions struct {
 	// DirectUpstream When true, the proxy dials this target via the host's network stack
 	// instead of through its embedded NetBird client. Use for upstreams
 	// reachable without WireGuard (public APIs, LAN services, localhost
-	// sidecars). Default false.
+	// sidecars).
 	DirectUpstream *bool `json:"direct_upstream,omitempty"`
 
 	// PathRewrite Controls how the request path is rewritten before forwarding to the backend. Default strips the matched prefix. "preserve" keeps the full original request path.