fix(node): keep only the latest refused claims for the log-once state

The set that kept a refused node claim's warning to one line was keyed
by the reported email and never forgot one. Some refused emails, such
as a padded one or a new client holding a foreign subId, match no row
on the master, so a node rotating them grew the set without bound; a
snapshot made only of padded entries also skipped the warning.

Each node now keeps just the emails its latest snapshot was refused,
both return paths log, and the logged email is cut to 64 characters.

internal/web/service/node_foreign_client_test.go

@@ -366,3 +366,20 @@ func TestNodeSharedClientInAgreementIsNotRewritten(t *testing.T) {
 		t.Fatal("a node in agreement with the master was marked dirty for a re-push")
 	}
 }
+
+// The refused emails are the node's choice, so the state that keeps their warning to one
+// line must not keep every name a node ever sent.
+func TestNodeRefusedClaimLogStateIsBounded(t *testing.T) {
+	db := initTrafficTestDB(t)
+	svc := &InboundService{}
+	seedNodeRow(t, db, &model.Node{Id: 1, Name: "n1", Address: "127.0.0.1", Port: 2096, ApiToken: "tok", Enable: true})
+	createNodeInbound(t, db, 1, "n1-in", 41001)
+
+	for i := range 50 {
+		syncNodeWithSettings(t, svc, 1, "n1-in", fmt.Sprintf(`{"clients":[{"email":"rotating-%d@x ","enable":true}]}`, i))
+	}
+	held, _ := reportedRefusedClaims.Load(1)
+	if got := len(held.(map[string]struct{})); got != 1 {
+		t.Fatalf("refused-claim log state holds %d emails for one node, want 1", got)
+	}
+}