feat(network): add host VLAN-bridge networking foundation

Introduce `modules.network`, the host-level networking foundation a Host
declares once. A Host states its trunk interface and the tagged VLAN ids to
materialize, and the module emits one systemd-networkd bridge per VLAN, named
by the `br-vlan<id>` convention, plus the host's own management address on a
chosen VLAN's bridge.

The trunk and every bridge set `RequiredForOnline = "no"` so wait-online never
blocks boot on a carrier-less link, and the module owns its own NetworkManager
`unmanaged` guard so enabling it is self-sufficient. Two assertions tie the
management VLAN to the declared VLANs and a management address to a VLAN, so an
address can never be silently dropped.

Enabled on neogaia as a tracer with placeholder values, proving the host build
and bridge-name evaluation through `nix flake check`. No Guest is wired to a
bridge yet.

hosts/neogaia/default.nix

@@ -44,6 +44,19 @@
 
   modules.toolkit.enable = true;
 
+  # The networking foundation, enabled like any module: proves the host build
+  # and bridge-name evaluation path through this host's `nix flake check`.
+  # The trunk, VLAN ids, and management address are placeholders a real homelab
+  # host replaces, and the placeholder trunk names no interface this laptop has.
+  modules.network.enable = true;
+  modules.network.trunk = "enp1s0";
+  modules.network.vlans = [
+    10
+    20
+  ];
+  modules.network.management.vlan = 10;
+  modules.network.management.address = "10.0.10.2/24";
+
   # The walking-skeleton guest, enabled like any module: proves the guest path
   # end to end through this host's `nix flake check`.
   guests.sample.enable = true;