Story 0.4 — Host firewall teardown on `kube cluster uninstall` (node-agnostic)

**Epic:** #777 — Host network firewall (node-agnostic)

Design: [v4 design](https://github.com/automa-saga/traffic-shaper/blob/main/docs/bn-qos-multiclass-priority-design-v4-nft-priority.md) §8.3.1, §8.3.3, §8.4.5.

Tear down the node-level host firewall at `kube cluster uninstall` — the reverse of Story 0.1 (#778), which wires `network firewall create` into `kube cluster install`. Host-firewall teardown is **node-agnostic and owned by the host/cluster layer**, NOT `block node uninstall` (#763): the `inet host` table protects the bare-metal host (SSH/mgmt) regardless of which workloads are installed, so uninstalling a block node must never strip it.

**Acceptance criteria:**
- Invoke `network firewall delete` (the generic command, #757) from the `kube cluster uninstall` path, after any workload-plane teardown (#763) has run.
- Remove the `inet host` table, `/etc/solo-provisioner/network-host.nft`, and the lock dir `/run/solo-provisioner/network/`.
- Disable/remove the **shared** `solo-provisioner-network-nft.service` oneshot **only if `network-weaver.nft` is also absent** (the unit is shared with `inet weaver` — TS_2 #743/#780); otherwise leave it enabled so the weaver plane still replays at boot.
- Idempotent and tolerant of partially-installed / never-installed state (no-op if the `inet host` table was never created).
- Runs for all node types (block, consensus, mirror, relay) — not gated on `block`.
- Ordering: tear down the host firewall last (after workload-plane deletes), so management access is retained for as long as possible during decommission.

Start at the kube cluster uninstall entry point and trace the existing workload-plane teardown, then follow the generic network firewall delete command. Verify the host table, /etc/solo-provisioner/network-host.nft, and /run/solo-provisioner/network/ are removed for every node type, while the shared service remains when network-weaver.nft exists; repeat the operation from a partial or absent installation.

Written by the indexing model from the issue text.