feat(cli): remove one tunnel restriction (#2725)

[bgm-malbeclabs]

Summary of Changes

This PR adds the ability from the CLI and the smart contract to add simultaneous tunnels: a single unicast and a single mulitcast tunnel (subscriber or publisher only). This also ensures that a second tunnel appears on a second device.

This also ensures that a mcast subscriber gets a device derived by tunnel_dst rather than dz_ip since subscribers aren't assigned a dz_ip.

This PR is split out from #2728 so that we can roll this out more safely and in two discrete steps (cli changes then activator,controller changes)

Closes #2725

Testing Verification

• E2E tests were extended to include creating multiple tunnels for a single user
• The coexistence tests that were skipped are now enabled and pass
• This also adds tests to verify that pubkey is always the last deserialized field in both go and rust
• Claude helped extend the tests

[Copilot]

Pull request overview

This PR enables simultaneous unicast (IBRL) and multicast tunnels from a single client by creating separate user accounts per tunnel type. Previously, only one tunnel was allowed per client IP.

Changes:

• Added capability helper methods in the smart contract to determine user capabilities based on state rather than UserType alone
• Modified CLI logic to create separate user accounts (PDAs) for different tunnel types on the same client IP
• Enhanced device selection to exclude IPs already used by the client's existing tunnels
• Extended E2E tests to verify concurrent tunnel scenarios

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
smartcontract/programs/doublezero-serviceability/src/state/user.rs	Added capability helper methods to determine user state and comprehensive tests for tunnel state detection
smartcontract/programs/doublezero-serviceability/src/processors/accesspass/set.rs	Added test to verify rent allocation constant covers concurrent publisher+subscriber configurations
e2e/multicast_test.go	Removed test that enforced single tunnel restriction
e2e/internal/devnet/client.go	Added constants for user types and method to wait for multiple tunnels
e2e/internal/arista/commands.go	Enhanced documentation for PIM neighbor JSON structures
e2e/ibrl_test.go	Removed test that enforced single tunnel restriction
e2e/ibrl_multicast_coexistence_test.go	Re-enabled coexistence tests and added new single-client concurrent tunnel tests
client/doublezero/src/dzd_latency.rs	Added IP exclusion parameter to device selection to ensure concurrent tunnels use different devices
client/doublezero/src/command/status.rs	Updated latency test values to reflect new tolerance
client/doublezero/src/command/connect.rs	Refactored user lookup by UserType, added logic to create separate user accounts for concurrent tunnels
CHANGELOG.md	Added entry documenting removal of single tunnel constraint

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[packethog]

Gonna test this again @bgm-malbeclabs