fix(node): clear a client's orphan mark when it is attached again

A client with an inbound link is not an orphan, but the node sweep's
mark was cleared only at the end of a node merge. An admin attach left
a stale mark, and ReapSyncOrphans deleted the client at its next
detach, traffic and IPs included, without the grace window.

Inserting a link now clears the mark of the clients it links, and the
reaper rereads its candidates inside its writer, so an attach that
commits after the list was read is not reaped.

internal/web/service/client_link.go

@@ -387,6 +387,18 @@ func (s *ClientService) reconcileInboundLinks(tx *gorm.DB, inboundId int, wanted
 		}).CreateInBatches(toInsert, 200).Error; err != nil {
 			return nil, err
 		}
+		// Not left to the next node merge: there may never be one, and a mark that outlives the
+		// attach hands the client to the reaper on its next detach.
+		linked := make([]int, 0, len(toInsert))
+		for _, link := range toInsert {
+			linked = append(linked, link.ClientId)
+		}
+		for _, batch := range chunkInts(linked, sqlInChunk) {
+			if err := tx.Model(&model.ClientRecord{}).Where("id IN ? AND sync_orphaned_at > 0", batch).
+				Updates(map[string]any{"sync_orphaned_at": 0, "sync_orphaned_by": 0}).Error; err != nil {
+				return nil, err
+			}
+		}
 	}
 
 	relinked := append([]int(nil), toDelete...)