Replace Cluster Control Plane

Replace a Hetzner cluster's control-plane servers with another type, one at a time.

Only for production-tier clusters, which run 3 control-plane servers: replacing one leaves the other two (etcd quorum). Management clusters are refused because their control-plane nodes need 8 GB or more. The cluster goes to UPGRADING before the job is queued, so drift, rollovers and autoscaling changes leave the stack alone until the worker finishes.

A replacement the worker stopped stays UPGRADING (its status message starts with "Control-plane replacement stopped"). Calling this again re-queues it without unlocking the stack; the worker resumes where it stopped. If the job died without recording that (a worker crash), force re-queues any replacement still marked UPGRADING, unless BullMQ still holds a replacement job for the cluster (queued, running or awaiting a retry).