feat: reconcile host identity and placement #30

Problem

Different addresses and booted operating systems can describe the same hardware.
Already adopted duplicates need reviewed correction. A combined source digest
cannot explain hardware, installation and interface continuity independently,
and equal MACs or names cannot safely merge records. A VM migrated outside
Omloom also needs its recorded host corrected without replacing the guest.

Deliverable

Add typed source-qualified identity evidence, bounded comparison and reviewed
identity correction through the persistent API and desktop/phone interface.
Distinguish one host with separate OS installations from duplicate records of
the same installation. Reuse current observation reconciliation for address
changes without creating address history or rewriting service binds.

Provide a reviewed placement action for migrations already performed elsewhere.
Desktop dragging and phone/keyboard destination selection use the same endpoint
checks and conditional relationship mutation. This action records inventory;
it does not execute a hypervisor migration.

Acceptance

• Preserve distinct hardware/VM, OS installation, boot and interface evidence,
  including missing, cloned, randomized and movable identifiers.
• Resolve known reviewed mappings first. Restrict candidate lookups and all
  comparison evidence to current authorized context, with bounded indexed work.
• Preview retained identities, fields, source mappings, parent/interface conflicts
  and affected relations before one atomic revision-checked correction.
• Never transfer grants, credentials, account control or operation targets.
  Unresolved effects and ambiguous bindings block the affected correction.
• Preserve distinct installation services and inactive boot contexts. Complete
  address updates replace only that source; partial reads preserve omissions.
• Fence replay and retired identities across retry, concurrent edit, crash/reopen
  and restore. Keep bounded correction evidence and minimal necessary aliases,
  without subtree snapshots or an automatic history stream.
• Exercise dual boot, duplicate installation, reboot/reinstall, cloned UUID,
  repeated VPN MAC, moving dock, private Wi-Fi, reused scoped IPs and denied fields.
• Verify real persistent API and desktop/phone compare, preview, accept and
  correction journeys, including Back/draft preservation and unchanged no-op writes.
• Replace a VM's single current placement while keeping its incarnation, OS,
  interfaces, services and source mappings. Keep unchanged IPs or accept a
  separate current-address observation. Do not infer routes, binds or network
  and storage membership from the destination.
• Review actual old/new hosts and permitted inherited facets. Recheck endpoint
  rights, enclosing context, role, revisions, cycles, exclusivity and unresolved
  operations. Old placement-bound inheritance becomes unavailable; direct
  assignments and access rights remain independent of placement.
• Show permitted hardware paths, addresses and exact destination identities.
  Explicitly broaden a selection when necessary. Preserve the VM's visibility
  at its destination after closing details, independently of old list filters.
• Verify concurrent moves, hidden old hosts, stale roles/reviews, restart and
  unchanged no-op placement. Existing ambiguous placements require explicit
  resolution; upgrading never guesses which host to retain.
• Keep root browsing bounded, filter visibility before exact totals/pagination
  and verify mixed visible/hidden parents in both relationship directions.

Validation

Focused native-source, persistent reconciliation and authorization regressions;
generated contract checks, browser journeys and platform-native qualification.