e663e30221
Documentation only, no code: config schema + subnet/IPv6 allocation + -n/--network CRUD, persistent netns primitives, bridge provisioning (also doubles as reboot reconciliation), veth join at -r/--run time, -p port forwarding, then a crash-orphan cleanup sweep. Each step is independently buildable and manually verifiable, since the full feature is too large for one commit.