Add -n/--network config CRUD: schema, subnet/IPv6 allocation, CLI

Commit 1/6 of the network isolation feature (docs/networking-design.md):
config-only, no host-side effects yet. Adds NetworkEntry {name, kind,
subnet, ipv6, subnet6} and a networks config-file section parallel to
volumes; network_subnet.{h,cpp} for CIDR validation, overlap checking,
and auto-allocation (10.168.<n>.0/24 / fd00:168:0:<n>::/64, paired,
--subnet/--subnet6 overrides); -n/--network create/list/delete CLI,
dual-purpose like -v/--volume (alone creates, repeatable with -r to
join -- joining isn't wired up yet, just accepted).

-n was already taken by --no-nsenter; moved that to long-option-only
(--no-nsenter), matching --kill's "rare flag, no real loss" precedent,
since --network will be far more heavily used.

README.md

@@ -77,7 +77,7 @@ slocker-lite -V|--version
 | `-r, --run <image.tar>` | Mount, run `bwrap` in the foreground, then unmount and clean up on exit. Defaults to the image's own `Entrypoint`/`Cmd` (or `/bin/sh` if neither is set); pass `-- <command> [args...]` to override. |
 | `-u, --umount <layer-id>` | Unmount a previously mounted layer (the ID printed by `--mount`/`--run`, or from `containers-storage layers`). |
 | `-c, --cleanup <layer-id>` | Delete a layer and its ancestor chain from local storage (unmount it first). |
-| `-n, --no-nsenter` | With `--run`, bind the mount directly instead of `nsenter`-ing into `fuse-overlayfs`'s namespace. Automatic when running as root; use this to force it off otherwise. |
+| `--no-nsenter` | With `--run`, bind the mount directly instead of `nsenter`-ing into `fuse-overlayfs`'s namespace. Automatic when running as root; use this to force it off otherwise. |
 | `-D, --daemonize` | With `--run`, fork into the background: detaches from the controlling terminal (`setsid()`), ignores `SIGHUP`, and redirects stdin from `/dev/null` and stdout/stderr to a log file under `$XDG_STATE_HOME/slocker-lite/logs/`. Prints the session's pid and log path, then returns — the same pid `--list-processes`/`-x/--exec` use. |
 | `--user <user>` | With `--run`, run the command as this user (name or numeric uid) instead of the image's own declared user (or root, if it declares none). Resolved against the image's own `/etc/passwd`. Only takes effect when `--run` executes as root. |
 | `--group <group>` | With `--user`, use this group (name or numeric gid) instead of the user's primary group. |
@@ -92,6 +92,9 @@ slocker-lite -V|--version
 | `--list-volumes` | List all named volumes (see `-v/--volume`) with their host directory. |
 | `--delete-volume <name>` | Remove a named volume from the config. The host directory is left untouched. |
 | `--delete-volume-full <name>` | Like `--delete-volume`, but also recursively deletes the volume's host directory. |
+| `-n, --network <name>` | Create/manage a persistent named network: requires exactly one of `--extern` (has a path to the host's real network) or `--intern` (only reachable by other containers on the same network). `--subnet <cidr>` overrides the auto-allocated IPv4 range (`10.168.0.0/24`, incrementing per network); `--no-ipv6` disables (and `--subnet6 <cidr>` overrides) the auto-allocated IPv6 range, on by default. With `--run`, instead joins `<name>` to the container; repeatable, no membership limit. See [`docs/networking-design.md`](docs/networking-design.md) — as of this, network creation is config-only: no bridge/namespace/iptables state exists yet. |
+| `--list-networks` | List all named networks (see `-n/--network`) with their kind, IPv4 subnet, and IPv6 subnet (or `(no ipv6)`). |
+| `--delete-network <name>` | Remove a named network from the config. |
 | `--list-processes` | List running `--run` sessions found by their pid files under `$XDG_STATE_HOME/slocker-lite/run/`, with their pid, container name, and status (`running` or `exited`). |
 | `--clean-processes` | Remove stale pid files (see `--list-processes`) left behind by sessions that are no longer running. |
 | `-w, --write-config` | Write a complete config file (creating it, and its parent directory, if missing), filling in every option's current or default value. Useful to bootstrap one for hand-editing. Prints the config file's full path. |
@@ -176,6 +179,12 @@ global:
   unshare-cgroup: on
 volumes:
   mydata: /home/user/slocker-volumes/mydata
+networks:
+  mynet:
+    kind: extern
+    subnet: 10.168.0.0/24
+    ipv6: true
+    subnet6: fd00:168:0:0::/64
 ```
 
 `global.log-level` sets the default log verbosity (an explicit `--log-level` on
@@ -191,9 +200,15 @@ set `unshare-net: off` if you need the sandbox to see the host's network in
 the meantime. No other long options belong in a config file (one-shot
 commands like `--mount`/`--run`/`--user` don't). The `volumes` section is
 managed by `-v/--volume` (see above) rather than hand-edited — it's what
-`-r/--run`'s own `-v` usage looks named volumes up in. A missing config file
-is fine either way (nothing is overridden, and one gets created the first
-time `-v/--volume` is used).
+`-r/--run`'s own `-v` usage looks named volumes up in. The `networks` section
+is likewise managed by `-n/--network` rather than hand-edited — see
+[`docs/networking-design.md`](docs/networking-design.md) for the full
+persistent-network feature design (as of this, network creation is
+config-only: no bridge/namespace/iptables state exists yet, so
+`global.unshare-net` above is still the only thing actually affecting a
+sandboxed container's network access). A missing config file is fine either
+way (nothing is overridden, and one gets created the first time
+`-v/--volume`/`-n/--network` is used).
 
 Run `-w/--write-config` to bootstrap a config file: it writes out every
 supported option explicitly (filling in the current or default value for