fix(directory): dedupe access/admin groups on repeated promotion; stop self-healing on every GET

Three independent copies of the same bug: routes/discovery.js's
POST /discovery/promote/:slug (the actual "Promote" button in the UI)
and services/discovery_reconciler.js's autoPromote path both called
ResourceGroup.create() directly with no existence check -- unlike
routes/api_directory_admin.js's own ensureResourceGroup, which already
carried a comment describing this exact "groups appear 3x" bug and
fixing it, just not everywhere it occurred. ResourceGroup has no DB
unique constraint on (resourceId, groupCn), so a resource promoted
more than once (retried UI click, or the same LXC discovered from
multiple Proxmox cluster nodes) silently accumulated duplicate
access/admin rows every time. Added ResourceGroup.ensure() (the
existing check-then-create pattern, now on the model) and switched all
three call sites to it. New regression test in tests/reconciler.test.js.

Also: GET /api/directory-admin/resources ran a full group-model
self-heal fan-out (ensureSiteGroups per site + provisionResourceGroups
per resource, each several sequential LDAP round-trips) unconditionally
on every single list -- confirmed via code read as the actual
bottleneck once a directory has more than a handful of resources, not
data volume. Moved healing to where resources actually change instead
(POST/PUT /resources, POST /discovery/promote/:slug -- PUT had none at
all before this), and added POST /resources/heal-groups as an explicit
on-demand equivalent for backfilling a directory seeded before this
change.

nodejs/routes/discovery.js

@@ -169,20 +169,14 @@ router.post('/promote/:slug', async (req, res, next) => {
 			else throw e;
 		}
 		
-		// Link them
-		const crypto = require('crypto');
-		await ResourceGroup.create({
-			id: crypto.randomUUID(),
-			resourceId: resource.id,
-			groupCn: accessGroup,
-			accessLevel: 'user'
-		});
-		await ResourceGroup.create({
-			id: crypto.randomUUID(),
-			resourceId: resource.id,
-			groupCn: adminGroup,
-			accessLevel: 'admin'
-		});
+		// Link them. ensure(), not create(): a re-submitted/retried Promote
+		// click (or the modal being saved twice) had no existence check here,
+		// so repeated promotion attempts on the same resource accumulated
+		// duplicate access/admin group rows -- see ResourceGroup.ensure()'s
+		// comment on models/resource.js for why this can't rely on a DB
+		// constraint instead.
+		await ResourceGroup.ensure(resource.id, accessGroup, 'user');
+		await ResourceGroup.ensure(resource.id, adminGroup, 'admin');
 		
 		const meta = resource.metadata || {};
 		meta.managed = true;