fix(review): coderabbit follow-ups round 2

- status_test.go TestStatus_PeerStateByIP: replace
  require := assert.New(t) shadowing pattern with req := require.New(t)
  so setup assertions are fail-fast and the require package isn't shadowed.
  Add TestStatus_PeerStateByIP_MatchesIPv6 for the IPv6-only path.
- status.go PeerStateByIP: match against both State.IP and State.IPv6 so
  IPv6-only peers are found by the private-service tunnel lookup. Empty
  input short-circuits before the loop and empty State.IP/State.IPv6
  fields are treated as non-matches.
- proxy.go ValidateTunnelPeer: call enforceAccountScope(ctx, service.AccountID)
  after the service lookup, mirroring ValidateSession. Without it, an
  account-scoped (BYOP) proxy token could mint session JWTs for another
  account's domain.
- sql_store.go getClusterCapability: thread the caller's context into the
  GORM query via WithContext(ctx) so the lookup is cancellable and honours
  request deadlines. (Pre-existing on origin/main; included here because
  GetClusterSupportsPrivate added by this PR is now a caller.)

Skipped:
- proxyAcceptsMapping SupportsCustomPorts == true: the existing != nil
  check is intentional. The accompanying test in this PR
  (TestSendServiceUpdateToCluster_FiltersOnCapability) explicitly asserts
  "new proxy with SupportsCustomPorts=false should still receive mapping"
  — the non-nil check encodes "proxy is new enough to understand the
  protocol", not "proxy can bind custom ports". Tightening to *bool==true
  would break that design and the test.

management/internals/shared/grpc/proxy.go

@@ -1671,6 +1671,12 @@ func (s *ProxyServiceServer) ValidateTunnelPeer(ctx context.Context, req *proto.
 		}, nil
 	}
 
+	// Mirror ValidateSession: account-scoped (BYOP) proxy tokens may only
+	// validate and mint session cookies for their own account's domains.
+	if err := enforceAccountScope(ctx, service.AccountID); err != nil {
+		return nil, err
+	}
+
 	peer, err := s.peersManager.GetPeerByTunnelIP(ctx, service.AccountID, tunnelIP)
 	if err != nil || peer == nil {
 		log.WithFields(log.Fields{"domain": domain, "tunnel_ip": tunnelIPStr}).Debug("ValidateTunnelPeer: peer not found")