feat: add automatic guest network interface firewall enablement during policy apply operations

Add network_firewall_enabled_value helper to parse and inject firewall=1 into Proxmox network interface config strings, implement enable_guest_firewall_interfaces to update VM/LXC config with firewall=1 on all netX interfaces before writing rules, extend workload_config_url to build config endpoint paths for qemu/lxc guests, add interfaces_enabled field to apply_rules response showing which interfaces were

backend/tests/test_proxmox_provider.py

@@ -31,7 +31,9 @@ class FakeAsyncClient:
     async def __aexit__(self, *_: object) -> None:
         return None
 
-    async def get(self, _: str, **__: object) -> FakeResponse:
+    async def get(self, url: str, **__: object) -> FakeResponse:
+        if url.endswith("/config"):
+            return FakeResponse({"net0": "virtio=AA:BB:CC:DD:EE:FF,bridge=vmbr0,firewall=0", "name": "web"})
         return FakeResponse(
             [
                 {"pos": 0, "comment": "manual rule"},
@@ -83,8 +85,14 @@ async def test_apply_rules_replaces_only_marked_nexafabric_rules(monkeypatch: py
     assert result["applied"] is True
     assert result["rules_deleted"] == 1
     assert FakeAsyncClient.deleted_urls == ["https://pve.example:8006/api2/json/nodes/pve1/qemu/100/firewall/rules/1"]
-    assert FakeAsyncClient.put_urls == ["https://pve.example:8006/api2/json/nodes/pve1/qemu/100/firewall/options"]
-    assert FakeAsyncClient.put_payloads == [{"enable": 1}]
+    assert FakeAsyncClient.put_urls == [
+        "https://pve.example:8006/api2/json/nodes/pve1/qemu/100/firewall/options",
+        "https://pve.example:8006/api2/json/nodes/pve1/qemu/100/config",
+    ]
+    assert FakeAsyncClient.put_payloads == [
+        {"enable": 1},
+        {"net0": "virtio=AA:BB:CC:DD:EE:FF,bridge=vmbr0,firewall=1"},
+    ]
     assert FakeAsyncClient.posted_payloads == [
         {
             "type": "in",