NodeLink: one Jaah-managed share across hosting and bastion-routed nodes

Found while working Task 7538 (gmind Accounts NodeLink on dev). Itemized: 1. Let one Jaah-managed NodeLink span the hosting VPC and the main VPC (bastion) locations when the location store's network admits both. On dev, jaah-dev-shared (the Main VPC store) already admits 2049 from the dev hosted-machine group via hosting/peering.tf, but the single-location rule refuses attaching a hosted node (gmind-m8i-1-host) and a shared-host vnode (ts2-node6) to the same Accounts NodeLink. Without this, one org's token folder can't be shared across both kinds of node. 2. Node › NodeLinks "Not mounted: The node reports it isn't mounted" gives no cause on ts2-node6. Show the node's last mount error, as the NodeLink › Nodes tab does for gmind-m8i-1-host. 3. The Storage tab's "No route can reach them" warning sits under the policy block, below the fold. Put it beside Mount target IP, where the fix (Change) lives. 4. Operator Settings › Infrastructure › NodeLink: an empty Routed VPC network/account silently disables the overlap warning. Default them from the environment's own VPC/account, or flag them as unset on the NodeLink storage card. 5. Settings fields: pressing Enter in a text knob does nothing and leaves a "Save (n)" bar that's easy to miss. Make Enter save the field, or highlight unsaved knobs. 6. Host gmind-m8i-1 shows "Add node failed: The node couldn't start on its host" with no cause. If the cause was the NodeLink mount timeout, name it. Out of scope: changing dev/prod tailnet isolation; VPC peering changes. Done means: - Each item is shipped or explicitly rejected with a reason in the PR body. Required checks: ./dc check full

All 6 items shipped in PR #6091, queued to the merge lane. Quick gate and changed-area tests green. One managed NodeLink spans hosting and Main VPC nodes behind an operator knob, with clearer mount and add-node causes, warning placement, an unset-knob flag and Enter-to-save. Review lane passed after 2 tenant IP-leak fixes. Follow-up draft #7621.