fix(gateway): handle duplicate WireGuard IPs

[Leechael]

Summary

• add an admin ForceRemoveInstance RPC to evict a specific instance and reconfigure WireGuard
• avoid reusing a stored CVM IP when another instance already claims it
• add regression coverage for both conflict recovery paths

Repro case covered by tests

1. Register instance A and allocate a WireGuard IP.
2. Simulate stale persisted state by inserting instance B with the same IP.
3. Verify the generated WireGuard config contains duplicate AllowedIPs = <ip>/32 entries.
4. Call force_remove_instance for the stale instance and verify the duplicate AllowedIPs entry is gone.
5. Separately, re-register instance B and verify it gets a fresh non-conflicting IP instead of reusing A's IP.

Tests

• cargo test -p dstack-gateway-rpc -p dstack-gateway
• cargo test -p dstack-gateway