fix(service): require non-empty host + direct_upstream on cluster targets

Cluster targets dial the upstream via the host network stack, so an
empty Host leaves the proxy with nothing to dial and DirectUpstream=false
would route the request through the embedded NetBird client (wrong
network for a cluster address). Validate() and validateTargetReferences
now reject both shapes.

Tests:
- TestValidate_HTTPClusterTarget / _RequiresTargetId /
  TestValidate_Private_{AcceptsClusterTargetWithAccessGroups,
  RequiresAccessGroups, RejectsBearerAuth} updated to populate Host and
  DirectUpstream so they exercise the path past the new gates.
- TestValidate_HTTPClusterTarget_RequiresHost and _RequiresDirectUpstream
  pin the two new error paths.
- TestValidateTargetReferences_ClusterTargetSkipsLookup updated to set
  DirectUpstream on its fixture; new _ClusterTargetRequiresDirectUpstream
  test covers the store-side rejection.

Drive-bys (no behavior change beyond what existing tests cover):
- proxy/proxy.go: shortened the Capabilities.Private / Cluster.Private
  doc comments.
- users/manager.go: moved the GetUserWithGroups doc from the interface
  to the impl.
- proxy/cmd/proxy/cmd/root.go: removed unused NewRootCmd.
- tunnel_cache.go: bumped tunnelCacheTTL from 30s to 300s (matches the
  "5 minutes" target documented on the constant; existing TTL-expiry
  test uses the constant directly so the bump is picked up automatically).

proxy/cmd/proxy/cmd/root.go

@@ -126,16 +126,6 @@ func Execute() {
 	}
 }
 
-// NewRootCmd returns the proxy server cobra command for embedding under
-// another binary (for example as the "proxy" subcommand of the netbird
-// client). The returned command shares its flag set, RunE, and any
-// previously registered subcommands (e.g. "debug") with the standalone
-// binary, so flag and env-var contracts stay identical across both
-// invocations.
-func NewRootCmd() *cobra.Command {
-	return rootCmd
-}
-
 // SetVersionInfo sets version information for the CLI.
 func SetVersionInfo(version, commit, buildDate, goVersion string) {
 	Version = version