Moving CP seems to be a pain, and phpmyadmin on every server already in the roadmap.
Assuming control panel is Lightweight why not have the functionality (along with ability to lock down e.g. by source IP and with 2fa) on every server by default, with replication of lightweight dB e.g. sqlite.
If difficult to design from a dB perspective you could have an a single live master and redirection (the others all slave/standby) along with election process to automatically nominate the master in the event of failure along with fail back. Ideally integrated with DNS/cloud flare so that the hostname follows the master, but an auto redirect to whichever is the master would be fine as well.
This way if one server died it doesn't matter you can just access on another using the same URL and start recovering/restoring immediately.
Following on from this..
as we are a cluster with auto-failover of control panel combined with DNS management we can auto-failover websites and update DNS...
