P7 r2 fixes: drift guard wired through pushIfNoDrift (acl_drift_detected ProviderError, never overwrites drifted remote) + unknown-device forward_auth audit + drift regression tests

dashcaddy-api/src/network/acl-sync.js

@@ -92,7 +92,19 @@ function createAclSync({ coordClient = null, tailnet = '-', pusher = null, compi
      * @returns {Promise<{pushed: true, hash: string}>}
      */
     async push(policy) {
-      return push.pushPolicy(policy);
+      // Drift guard (spec hard rule): never silently overwrite remote ACL
+      // edits made outside DashCaddy. pushIfNoDrift compares the stored
+      // last-known-good hash against the remote acls hash first; a drifted
+      // remote resolves {drifted:true, pushed:false} which the caller must
+      // surface (provider maps it to ProviderError 'acl_drift_detected').
+      const result = await push.pushIfNoDrift(policy);
+      if (result && result.drifted && !result.pushed) {
+        const err = new Error('remote ACL policy drifted from last-known-good; refusing to overwrite');
+        err.code = 'acl_drift_detected';
+        err.drift = result;
+        throw err;
+      }
+      return result;
     },
 
     /** Local last-known-good state (null when never pushed). */