OF-3037: Expose failed outbound S2S sessions in admin console with diagnostics
This change extends server session administration to include failed outbound S2S connection attempts alongside active sessions.
Failed domains are now shown in the server session overview with clear visual indication, and selecting one opens a dedicated diagnostics page (instead of normal session details) that supports quick retry and block workflows by redirecting to existing admin pages with the failed domain pre-populated.
Under the hood, `OutgoingSessionPromise` now records the latest failed attempt per remote domain in a new clustered cache using a serializable diagnostics payload, and clears that failure state after a successful reconnect. The diagnostics page also includes roster-domain usage search for impacted local users, backed by a new domain-targeted roster lookup API with an optimized implementation in `DefaultRosterItemProvider` (plus compatible fallback behavior for custom providers).
