Nodes advert WS handler: invalidate-then-loadNodes(true) can coalesce onto an in-flight /nodes request (same shape as #243) #279

Follow-up from the round-2 re-review of #263 (#243), finding N3. public/nodes.js (around lines 684 and 711): the advert WebSocket handler calls invalidateApiCache(...) and then a plain loadNodes(true). The #243 fix lives at the call site (api(..., { bust: true })), not inside invalidateApiCache(), so this path can still join an older in-flight /nodes request and render stale data. Apply the same bust pattern, or decide to move the bust into invalidateApiCache() for every caller. Add a unit test with controlled api() timing and a mutant check. The same review also notes (N1) that the revoke-path bust is only pinned transitively, so add a direct test for onRevoked while you are there.