feat(agentnetwork): record which proxy serves an account

Adds ServingProxyAddress to the agent-network settings row and makes the
synthesized service advertise it as the proxy that serves the account. Empty
-- the value for every existing row -- means the shared proxy named by
Cluster serves the account, which is the previous behaviour exactly.

This is the only mutable column on the row. Cluster, Subdomain and Zone are
fixed once written, but moving an account onto a dedicated proxy, and moving
it back, is exactly one write here. Because mesh DNS peer selection and the
mapping-delivery filter both join on the advertised address, that single write
is what redirects an account's traffic, with no change to either join.

Only the advertised address follows the new column. The placeholder target's
ID stays pinned to Cluster: it names a target the router rewrites per request
and is not a routing decision.

Nothing in this repository writes the column; it is set by whatever process
assigns dedicated proxies. A store setter is included so that assignment can
be a single scoped update rather than a read-modify-write over the whole row,
which would race with unrelated settings changes.

management/server/types/account.go

@@ -364,8 +364,9 @@ func (a *Account) privateServiceDomainZone(svc *service.Service) string {
 	// explicitly: it is server config, so it matches neither the serving
 	// proxy's address nor any per-account custom-domain row. Checked first so
 	// the apex stays the zone even once ProxyCluster becomes the tenant
-	// hostname itself (a private managed proxy), which would otherwise make the
-	// apex the full hostname and churn the client's zone set on cutover.
+	// hostname itself (which happens when a dedicated per-account proxy serves
+	// it), which would otherwise make the apex the full hostname and churn the
+	// client's zone set when a tenant moves between proxies.
 	if svc.DNSZone != "" && domainFromSuffix(svc.Domain, svc.DNSZone) {
 		return svc.DNSZone
 	}