One firewall per server

Servers can now be assigned to only one firewall at a time. Assigning a server that's already attached elsewhere returns a clear conflict instead of a duplicate, ineffective assignment.

Existing duplicate assignments aren't cleaned up automatically. A database-level safeguard is coming once production data has been reconciled.