fix(infra): reject conflicting recovery records in teardown

An interrupted provisioning run can leave a stale server_id file alongside
a newer last-created-hostname; teardown silently preferred the id and could
delete the previous server while the newly billed host kept running. When
the id comes from the state file and a hostname record exists, verify via
the provider that both identify the same server and abort on a conflict
(or on a failed lookup) with explicit recovery guidance. An explicit
LATITUDE_SERVER_ID still bypasses the check.

Co-authored-by: Cursor <cursoragent@cursor.com>