chore(agentnetwork): fix config grouping, dead code, comments, coverage

- Move the new zone config key into the existing AgentNetwork config
  group (management/internals/server/config/config.go) instead of a
  sibling top-level field, wire modules.go to the new path, add the
  matching field to combined/cmd/config.go's AgentNetworkConfig and its
  mapping (it was previously unreachable in the combined binary), and
  document the key in infrastructure_files/management.json.tmpl and
  combined/config.yaml.example.

- Delete PickUnique and its three tests: Task 5 removed its last
  production caller, leaving it dead exported code with a stale
  words.go comment pointing at it.

- Reword two test comments that referenced our private review process
  instead of stating what the test locks down / why TargetId stays
  pinned to Cluster.

- Add TestBootstrapSettings_NonRetryableErrorFailsImmediately: a
  regression that dropped the isUniqueConstraintError gate and retried
  on every error would leave every existing allocator test green.

- Fix TestSynthesizeServiceForDomain_DegenerateInput's docstring: the
  early-return guard is an optimisation, not what makes "" and
  "localhost" resolve to no service.

- Replace manager.go's allocation-comment archaeology (a deleted
  per-cluster "taken" set, an `accountID[:4]` suffix, "~68 minutes") with
  the actual invariant, and note why each retry attempt gets its own
  transaction (a failed statement poisons the enclosing transaction on
  postgres).

- Collapse the per-service "no matching zone apex" debug log in
  account.go into a single line per call instead of one per skipped
  service.

- Document why idx_agent_network_settings_cluster_subdomain must stay
  on mysql: its index tag is what sizes subdomain as varchar(191)
  rather than longtext, which the new unique index requires.

management/server/store/store.go

@@ -672,6 +672,12 @@ func getMigrationsPostAuto(ctx context.Context) []migrationFunc {
 			// The pre-existing idx_agent_network_settings_cluster_subdomain is
 			// left in place: it is non-unique and indexes subdomain alone
 			// (Cluster carries no tag), so it neither conflicts nor suffices.
+			// It must also stay for a second, load-bearing reason on mysql:
+			// its gorm:"index:" tag on the Subdomain field is what makes gorm
+			// size that column as varchar(191) instead of longtext. mysql
+			// cannot put a longtext column in a unique index at all, so
+			// dropping this "redundant" index as unneeded would silently
+			// break the migration above on that dialect.
 			return migration.CreateIndexIfNotExists[agentNetworkTypes.Settings](
 				ctx, db, "idx_agent_network_settings_subdomain_unique", "subdomain",
 			)

management/server/types/account.go

@@ -254,6 +254,7 @@ func (a *Account) SynthesizePrivateServiceZones(peerID string) []nbdns.CustomZon
 
 	peerGroups := a.GetPeerGroups(peerID)
 	zonesByApex := map[string]*nbdns.CustomZone{}
+	var skippedNoZoneApex []string
 
 	for _, svc := range a.Services {
 		if svc == nil || !svc.Enabled || !svc.Private {
@@ -275,9 +276,12 @@ func (a *Account) SynthesizePrivateServiceZones(peerID string) []nbdns.CustomZon
 			// This service passed every gate above (enabled, private,
 			// AccessGroups, connected proxy peers) and would otherwise have
 			// emitted a record, but its domain matches neither its DNSZone,
-			// its ProxyCluster, nor any validated custom-domain row.
-			log.Debugf("private-zone synth: svc %s domain=%s cluster=%s dns_zone=%q has no matching zone apex, skipping",
-				svc.ID, svc.Domain, svc.ProxyCluster, svc.DNSZone)
+			// its ProxyCluster, nor any validated custom-domain row. Collected
+			// rather than logged here — this runs per peer x per service, and
+			// logging inline here would reintroduce the per-peer noise the
+			// "0 zones" diagnostic below deliberately avoids.
+			skippedNoZoneApex = append(skippedNoZoneApex,
+				fmt.Sprintf("%s(domain=%s cluster=%s dns_zone=%q)", svc.ID, svc.Domain, svc.ProxyCluster, svc.DNSZone))
 			continue
 		}
 
@@ -331,6 +335,10 @@ func (a *Account) SynthesizePrivateServiceZones(peerID string) []nbdns.CustomZon
 				svc.ID, svc.Domain, svc.ProxyCluster, len(proxyPeers), skippedDisconnected)
 		}
 	}
+	if len(skippedNoZoneApex) > 0 {
+		log.Debugf("private-zone synth: peer %s account %s skipped %d service(s) with no matching zone apex: %s",
+			peerID, a.Id, len(skippedNoZoneApex), strings.Join(skippedNoZoneApex, ", "))
+	}
 
 	out := make([]nbdns.CustomZone, 0, len(zonesByApex))
 	for _, zone := range zonesByApex {