Release a quarantined or draining host back to active (admin).

One symmetric route for both gate-blocked states; a no-op (still 200) when the host is already active. A pending host has never enrolled — activation, not reactivation, is its path.

Reactivation asserts the physical box behind the row is alive and unchanged: refused (409) when the heartbeat is stale or absent, because a wiped/replaced box must go through delete + fresh enrollment, never a bare state flip. Any live box heartbeats — via the boot gate while passive or the agent while serving — so freshness is always available when reactivation is legitimate. force=true is the explicit operator override.