Story 0.2 — Host mgmt-CIDR config: `--mgmt-cidrs` flag + profile default

[brunodam]

Epic: #777 — Host network firewall (node-agnostic)

Design: v4 design §8.4.1.

Provide the management-CIDR config surface for the host firewall. The host's own SSH/mgmt access is solo-provisioner/host-level config (it protects the bare-metal host the provisioner runs on) — it is NOT installed-component config, so it does not belong in a component's values.

Acceptance criteria:

• Add --mgmt-cidrs (and --ssh-port, ICMP policy) to kube cluster install, forwarded to network firewall create.
• Profile-driven default: a host-level HostConfig.ManagementCIDRs (pkg/models/config.go); profiles are global per-machine, so the default applies to whatever node type the host runs.
• Day-2 changes are operator-driven via the generic network firewall add/remove/set --mgmt-cidr verbs (Story 1.1 — Implement network firewall verbs on the inet host table #757) — no re-install required.
• ICMP policy (--icmp-mgmt/--icmp-public) depends on the same mgmt-CIDR set (planning note 9).
• Document the ownership: mgmt CIDRs are a host/cluster-install input, not a block node install input.