#16948 cmux-next Cloud: add private network operations

Adds owner-scoped private network operations for cmux-next Cloud.

Includes tunnel attach/detach/key rotation, firewall CRUD, typed catalog entries, and palette/CLI/MCP handlers with validation and tests.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Adds owner-scoped private network operations for cmux-next Cloud: tunnel attach/detach and WireGuard key rotation, plus firewall rule CRUD, surfaced in the macOS palette, CLI, and MCP through new handlers and API routes.

• Tunnel and firewall operations fail closed if the device fingerprint, network, VM, or tunnel referenced isn't owned by the caller.
• Tunnel and firewall mutations now await their results in the palette instead of running detached.
• Firewall rules only allow the allow action; endpoints may name a single resource, CIDR, or public traffic, with validated CIDR ranges and ports that require a protocol.
• cloud firewall-create expects JSON with source and destination endpoints and an optional description.
• The macOS API client percent-encodes query selectors so ids containing reserved characters resolve correctly.
• Adds tests for tunnel mutation routes and firewall query escaping.