fix(cli): journal that allowed destinations fail closed on a maintenance start

A maintenance fallback start holds no resolver config, and Allowed
Destinations (a master-only Firewall Mode feature) are not persisted with
the configuration on disk. Under Firewall Mode the exception set is
therefore empty until the API answers, so raw-IP destinations the
organization allowed stay blocked for the window, and a persisted pf
table from the previous run is replaced by the empty set.

Keep that fail-closed on purpose: the list is the organization's network
topology and is kept out of persisted state. Journal a Warn when a
fallback start applies the empty set under Firewall Mode so the blocked
destinations are explained, and pin that the first answer after recovery
re-applies the list.

Also capitalize the two managed-config marker log messages to match the
rest of master.

cmd/cli/api_maintenance.go

@@ -224,7 +224,7 @@ func persistManagedConfig(cfg *ctrld.Config, logger *ctrld.Logger) {
 		return
 	}
 	if err := recordManagedConfig(cdUID); err != nil {
-		logger.Warn().Err(err).Msg("could not record that this configuration came from the API")
+		logger.Warn().Err(err).Msg("Could not record that this configuration came from the API")
 	}
 }
 
@@ -246,6 +246,6 @@ func recordManagedConfigForStart(fetchedThisRun, wasManagedBeforeWrite bool) {
 	if err := recordManagedConfig(cdUID); err != nil {
 		// Not fatal: this run is fine. It only costs the next start its
 		// fallback if the API is in maintenance then.
-		mainLog.Load().Warn().Err(err).Msg("could not record that this configuration came from the API")
+		mainLog.Load().Warn().Err(err).Msg("Could not record that this configuration came from the API")
 	}
 }