Add VLANs, firewall zones and inter-zone rules

LANs can sit on an 802.1Q VLAN (`vlan` on a trunk `interface`); networkd
creates the device and brings the trunk up. LANs belong to a named `zone`
(default: their own name). Traffic inside a zone is forwarded freely, traffic
between zones is denied unless a `router.firewall.rules` entry allows it
(protocol, ports, optional destination inside the target zone).

Internet access is now opt-in per LAN (`internet`, default false), replacing
the previous allow-out default. Assertions reject unknown zones, bad
destinations, duplicate devices, over-long device names and a WAN trunk.

Kea subnet IDs now come from the network address so adding LANs does not
renumber them and orphan persistent leases.

Tests: a five-VM `vlans` check (untagged + two VLANs, shared zone, one-way
rules, per-host destination restriction), new assertion cases, parseNet unit
tests, and shared test tooling in tests/common.nix.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tests/common.nix

@@ -0,0 +1,22 @@
+# Pieces shared by the VM tests.
+{
+  # `fail` in a test script also passes on "command not found", so make sure
+  # the tools the scripts rely on are really there.
+  tools =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = with pkgs; [
+        dnsutils
+        netcat-openbsd
+        curl
+        tcpdump
+      ];
+    };
+
+  # `driverInteractive` uses the full QEMU, which would open a window per VM;
+  # `nix run .#lab` wants the consoles in the terminal instead.
+  interactiveDefaults.virtualisation.qemu.options = [
+    "-display"
+    "none"
+  ];
+}