fix: make update-alert routing concurrency-safe

[crypt0rr]

Summary

• Fail closed when unit or platform update-routing state cannot be read.
• Add a password-confirmed per-destination toggle that applies to the latest saved routing, preventing concurrent administrators from overwriting each other's selections.
• Keep paused and locked destinations routable, preserve legacy defaults, and align host visibility badges with the RDAP special-use policy.

Validation

• Frontend lint, production build, unit coverage (349 tests), and coverage gates passed.
• Focused Go routing and visibility tests, focused race tests, and passed.
• Full Go race suite and complete browser suite are being verified; CI runs the full required gates.

Fixes #1007
Fixes #1008
Fixes #1009