Start fence-gated earners only after the fence is restored, including after a reboot #285

Fence-gated containers (Mysterium) keep the restart policy every earner gets, unless-stopped. After a reboot, Docker therefore starts the node before CashPilot Desktop has written the LAN fence again. In that window the fenced network has no masquerade, so the node has no internet route, but nothing drops what it sends to the machine itself. The node's own --firewall.protected.networks still applies inside its namespace. The gap is documented in catalog-overlay/README.md under "Fields Desktop reads differently".

The web worker closes it, and that behaviour should be ported (app/orchestrator.py and app/lan_fence.py guard in GeiserX/CashPilot, introduced with #665):

• deploy fence-gated containers with restart policy no;
• keep a persisted record of the fence-gated containers the user stopped, so a stop from the dashboard stays a stop (the web's .fence_gated_stopped marker);
• start each fence-gated container that is down and not user-stopped, but only after the fence has been read back. This runs at app start and on each fence recheck, which covers a reboot and a crash;
• show a stopped fence-gated node as "waiting for the fence", not as a container that is down.

Raised in review: #283 (comment)