Epic TS_1 — solo-provisioner network command family

Design: [v4 design](https://github.com/automa-saga/traffic-shaper/blob/main/docs/bn-qos-multiclass-priority-design-v4-nft-priority.md) §8.4.

Implement the operator-facing `solo-provisioner network` command family — the single, generic, command-driven surface for all nft + tc + MetalLB state behind the BN traffic shaper (v4). Four scopes:

- `network firewall` — node-level allowlist (`inet host`).
- `network policy` — per-category nft rules + priority class (`inet weaver`), with `--stamp`/`--deny`/`--reply-stamp`, a policy registry, and tier-order chain re-render.
- `network shape` — tc HTB classes and device roots (the bandwidth plane on `$VETH` and `$EGRESS`).
- `network lb` — MetalLB pools/advertisements.

Every mutation applies to the live kernel **and** atomically rewrites its on-disk artifact under `/etc/solo-provisioner/` (replayed at boot by TS_2's oneshot units). The static plane is rendered exclusively through these commands; `block node install` (TS_2) and the daemon monitor (TS_3) invoke them. This is the foundation epic.

**Note (design decision):** direction and device are derived, not independently-settable flags. Every class in the design's §5 mark map has exactly one direction, so `network policy create` derives `--direction` from `--stamp`, and `network shape create` derives `--device` from `--class`; neither scope takes a free-standing direction/device flag on those forms (see design doc §5/§8.4.2/§8.4.3).