feat: multiple gateways and explicit sharding semantics

## Goal

Support multiple named gateways concurrently and design explicit gateway sharding/failover without treating a singleton VPN tunnel as an HPA workload.

## Acceptance

- [ ] concurrent gateways have isolated overlay, lease, DNS, and firewall ownership
- [ ] admission and authorization select the intended gateway deterministically
- [ ] sharding identity, placement, disruption, and failover semantics are documented in an ADR
- [ ] losing one shard cannot create direct-egress fallback or corrupt another shard
- [ ] migration from the v0.2 singleton model is documented