A simple `sudo service neutron-server restart` fixed the problem. All credentials on disk looked identical between the three units, crm status was clean.
The error that tipped me off was `neutron floatingip-list` occasionally getting a 500, traced to neutron-api which showed this:
2015-05-18 16:55:47.592 57957 WARNING keystonemiddleware.auth_token [-] Invalid user token. Keystone response: {u'error': {u'message': u'The request you have made requires authentication.', u'code': 401, u'title': u'Unauthorized'}}
2015-05-18 16:55:47.593 57957 WARNING keystonemiddleware.auth_token [-] Authorization failed for token
I'll attach charm logs for all three units (juju and neutron).
Hmm - this sounds familiar - I think there was a packaging fix in keystonemiddleware to resolve this