Epic TS_2 — Static-plane install & reboot persistence

Design: [v4 design](https://github.com/automa-saga/traffic-shaper/blob/main/docs/bn-qos-multiclass-priority-design-v4-nft-priority.md) §2 (Decision 1), §8.2, §8.3.

Lay down and persist the static plane of the BN traffic shaper (v4): the one-time `block node install` orchestration, the systemd oneshot units that replay nft/tc state at boot, and the single Cilium knob the design depends on.

**Scope:**
- Cilium `enable-host-legacy-routing: true` + `BandwidthManager: Disabled` guard.
- `block node install` orchestrates `network firewall/shape/policy/lb create` (idempotent); requires `--egress-bandwidth`, forwards `--shape` overrides; profile-driven defaults.
- `block node uninstall` reverse-order teardown.
- Reboot persistence: `solo-provisioner-network-nft.service` and `solo-provisioner-tc-egress.service` oneshot units + boot ordering (`Before=solo-provisioner-daemon.service`). Set elements and `$VETH` HTB are deliberately not persisted (statusz / runtime are the source of truth).
- daemon.yaml wiring (`monitors.traffic_shaper: true`, `daemon-bn.kubeconfig`) + local-fallback statusz config docs.

Builds on the `network` command family (TS_1).