Turning off one gateway's datapath breaks TCP through the others #963

Summary

When one gateway node in a site has its datapath turned off, TCP connections through the site's other gateway nodes fail for part of the traffic. UDP keeps working.

A backend's node sends replies to clients over equal-cost paths through every edge node in the site. Replies that land on the gateway whose datapath is off are not claimed as load balancer return traffic, so the kernel forwards them and connection tracking drops the TCP ones as invalid. The client never sees those connections complete.

The load balancer status still reports the rule as ready, because the node with its datapath off advertises none of the VIPs. The lab's datapath-off check only tests ingress through the node it turns off, so it does not catch this.

Acceptance criteria

• With one gateway node's datapath off, every TCP and UDP flow through the site's remaining gateway nodes completes
• The lab's datapath-off check sends traffic through the remaining gateway nodes and fails when replies are dropped
• A gateway node that goes away entirely leaves flows through the other gateway nodes intact

Related to #698