fix(errors): ingest snapshots under the authenticated caller identity

[woodsonl]

Description

The POST /v1/errors ingest handler trusted the SyncEnvelope's nodeId and
reconciled whatever it named. The caller is already authenticated by mutual
TLS, so the peer's real identity is the verified client UUID. The envelope's
own nodeId is redundant and can name another node.

This reconciles under the authenticated caller UUID and rejects an envelope
whose nodeId disagrees with it. The pin store keys peers by the same UUID the
push side uses as nodeId, so honest peers are unaffected; the mismatch case
only fires for a body that names someone else.

The ingest body is also bounded at the same 1 MiB the other inter-node
endpoints apply, so an oversized push is refused before it is decoded.

Release intent

Changelog title

Error sync ingests under the authenticated peer identity

Changelog body

The error-sync endpoint now records an incoming snapshot under the identity of
the peer that authenticated, rather than the identity named in the request
body, and refuses a body that names a different peer. Oversized ingest bodies
are refused rather than decoded.

Bumps

• services: patch
• nvpair-cluster-manager: none
• nvpair-engine-manager: none
• nvpair-errors: patch
• nvpair-job-scheduler: none
• nvpair-manual-nodes: none
• nvpair-node-info: none
• nvpair-node-scanner: none
• nvpair-node-settings: none
• nvpair-proxy: none
• nvpair-tui: none
• nvpair-ui-broker: none
• nvpair-workload-manager: none

Scope

Included: the caller-UUID reconciliation, the mismatch rejection, and the 1 MiB
body bound.

Excluded: the manager's local reconcile logic is unchanged; only the handler's
identity handling changes.

Validation

• go build ./... and go test ./... in services/nvpair-errors
• services/nvpair-errors/peersync_test.go covers a matching-nodeId ingest
  and a spoofed-nodeId rejection.

Risk

Low. A peer that already pushes its own nodeId is unaffected; the new 400
only fires when the body names a peer other than the authenticated caller.

Checklist

• I have read the Contributing Guidelines.
• Every commit is signed off (git commit -s), certifying the Developer Certificate of Origin.
• New or existing tests cover the change.
• Relevant documentation is updated.
• I checked the diff, changed filenames, and commit messages for credentials, private data, internal URLs, internal issue identifiers, and generated artifacts.
• I recorded the validation commands and results above.
• I declared version bumps in the release-intent block above. services/versions.json is written by automation — do not edit it by hand.