feat(cluster): startup peer-sync + stable primary-ID in ha_nodes

On API restart, cluster nodes now re-register their primary in the local
ha_nodes and reload nftables so @peer_ipv4 is correct after a package
update or reboot without requiring a re-join.

Also fixes duplicate ha_nodes rows: preRegisterPrimary previously used
time.Now().UnixNano() as node ID, creating a fresh row each call.
Now uses a deterministic ID derived from the FQDN so repeated upserts
are idempotent.

PrimaryFQDN is now persisted in setup.json during CompleteAsNode so the
startup sync knows which primary to contact.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cmd/edgeguard-api/main.go

@@ -60,7 +60,7 @@ import (
 	usersvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/users"
 )
 
-var version = "1.1.155"
+var version = "1.1.156"
 
 func main() {
 	addr := os.Getenv("EDGEGUARD_API_ADDR")
@@ -279,6 +279,9 @@ func main() {
 		setupHdl.WithClusterSupport(clusterStore, func(ctx context.Context) error {
 			return firewallrender.New(pool).Render(ctx)
 		})
+		// Cluster-Node-Startup: Primary in lokalen ha_nodes eintragen damit
+		// nftables @peer_ipv4 korrekt ist — auch ohne erneuten Join.
+		go setupHdl.StartupPeerSync()
 		usersRepo := usersvc.New(pool)
 		authHdl.WithAudit(auditRepo, nodeID).WithUsers(usersRepo)