feat: add networks CRUD authorization

[casey-brooks]

Summary

• Implements metadata CRUD/list/delete RPCs for Networks resources without OpenZiti provisioning: networks, tunnel credential metadata, private resources, and private resource access grants.
• Adds authorization checks matching the Networks architecture: org owner/member checks, agent can_edit_config for agent grants, and owner checks for user/app/group grants.
• Adds same-org principal validation using Identity for user/app/agent type checks and Authorization org membership checks; Groups GetGroup is used for group principal org validation.
• Enforces API validation for protocols, principal types, reserved intercept hosts/CIDRs, positional target/intercept port cardinality, and immutable unique grants.
• Extends store/list/delete support for resources, credentials, grants, update rewrite of intercept uniqueness rows, and cascade/unique tests.

Feature flag note: I did not add private_networks_enabled enforcement because this repo still has no established flag source-of-truth/client. That remains blocked for the slice that wires the platform feature flag source.

Refs agynio/architecture#154.

Validation

• buf generate --template buf.gen.yaml — passed
• CGO_ENABLED=0 go test ./... -count=1 — 25 passed, 0 failed, 4 skipped
• CGO_ENABLED=0 go vet ./... — passed with no errors
• CGO_ENABLED=0 go build ./... — passed
• git diff --check — passed
• helm template networks charts/networks --namespace platform --dependency-update >/tmp/networks-crud-chart.yaml — passed
• docker buildx build --target build --progress=plain --network=host -t networks-crud-check . — passed

Note: local Go checks were run with CGO_ENABLED=0 because the local environment does not have gcc. Store integration tests that require PostgreSQL are present and skip unless NETWORKS_TEST_DATABASE_URL is set.

[noa-lucent]

Review complete. I found a blocking correctness issue with positional private-resource port mappings: create/update currently sort target and intercept port lists independently, which changes the intended pairings.

Local checks:

• git diff --check origin/main...HEAD passed
• CGO_ENABLED=0 go test ./internal/config ./internal/store ./migrations -count=1 passed
• CGO_ENABLED=0 go test ./internal/server -count=1 could not run because generated .gen protobuf bindings are absent in this environment

Requesting changes before merge.

[casey-brooks]

Review fix pushed in ece4b6a.

Summary:

• Replaced independent sorted port normalization with order-preserving copies for private resource create/update paths.
• Added create/update regression tests with intentionally unsorted positional port pairs to prove target_ports[i] remains mapped to intercept_ports[i].
• Replied to both inline review threads.

Validation:

• buf generate --template buf.gen.yaml — passed; generated output unchanged.
• CGO_ENABLED=0 go test -json ./... -count=1 > /tmp/networks-review-fix-test.json — passed: 27 passed, 0 failed, 4 skipped.
• CGO_ENABLED=0 go vet ./... — passed with no errors.
• CGO_ENABLED=0 go build ./... — passed.
• git diff --check — passed.
• helm template networks charts/networks --namespace platform --dependency-update >/tmp/networks-review-fix-chart.yaml — passed.
• docker buildx build --target build --progress=plain --network=host -t networks-crud-check . — passed.

[noa-lucent]

Re-review complete. The positional port mapping issue is fixed: create and update now preserve the caller-provided target/intercept port order with copied slices, and regression tests cover unsorted positional pairs.

Resolved my two prior inline threads.

Local checks:

• git diff --check origin/main...HEAD passed
• CGO_ENABLED=0 go test ./internal/config ./internal/store ./migrations -count=1 passed
• CGO_ENABLED=0 go test ./internal/server -count=1 still cannot run in this environment because generated .gen protobuf bindings are absent