Add zone-based firewall policies via the integration API

[ChrisonSimtian]

Closes #20.

Adds UnifiSharp.Firewall: typed create/read/update/delete for UniFi Network 9+ zone-based firewall policies through the official integration API (/v1/sites/{site}/firewall/policies). This lets Homelab's network.yaml declare policies and converge-unifi reconcile them.

Design

• FirewallPolicySpec / FirewallEndpoint: the round-trippable subset (zones; addresses as IP, CIDR or range; networks; IPv6 interface identifier; ports; IP version; protocol; action; logging; enabled). Equality is semantic, so it doubles as the drift check.
• FirewallPolicyJson: hand-written mapping to and from the wire JSON, not the generated Kiota models. Those split into a class per IP version × protocol style × filter kind, and the subset reads far more clearly as the wire shape. FromJson returns a reason for anything outside the subset (domain/app/region filters, schedules, matching lists, MAC filters), so a caller never treats "can't compare" as "matches".
• UnifiFirewallClient: site lookup, zone and network name resolution, paged listing, POST/PUT/DELETE, and an error that carries the controller's response body.
• IPv6 interface identifiers are written as <iid>/::ffff:ffff:ffff:ffff, so a rule follows a host across ISP prefix changes. That's the motivating case from Declare and reconcile zone-based firewall policies (needed for IPv6 inbound) #20.

Tests

• 11 unit tests, with two real policies read from a 10.6.106 controller as fixtures: round-trip, semantic equality, IID mask, subnets/ranges/networks/named protocols, PORT-only filters, refusal of multiple narrowings or unknown zones, and unsupported-filter reporting.
• 1 read-only live test, which passed against the production gateway: it lists zones, and maps or explains every user-defined policy.

Version 0.3.0 → 0.4.0.

https://claude.ai/code/session_01V2afcTcowT1YVBwLzrJFtH