feat: add comprehensive CRUD endpoints, cluster sync improvements, and firewall orchestration

Add create endpoints for users, roles, tenants, projects, networks, subnets, and security rules with audit logging, implement commit_or_400 helper for IntegrityError handling with 409 responses, enhance cluster sync to populate nodes, workloads, and networks from provider inventory with last_sync_at tracking, add update/delete operations for IP addresses and policies with version tracking, implement IP

backend/app/schemas/domain.py

@@ -26,20 +26,85 @@ class UserRead(OrmModel):
     is_active: bool
 
 
+class UserCreate(BaseModel):
+    email: str
+    display_name: str
+    password: str = Field(min_length=12)
+    role_ids: list[str] = []
+
+
+class RoleCreate(BaseModel):
+    name: str
+    permissions: list[str] = []
+
+
+class RoleRead(OrmModel):
+    id: str
+    name: str
+    permissions: list[str]
+
+
 class ClusterCreate(BaseModel):
     name: str
     api_url: str
     api_token: str = Field(min_length=8)
+    provider: str = "proxmox"
     mode: str = "read_only"
     verify_tls: bool = True
 
 
+class TenantCreate(BaseModel):
+    name: str
+    description: str | None = None
+
+
+class ProjectCreate(BaseModel):
+    tenant_id: str
+    name: str
+    description: str | None = None
+
+
+class NetworkCreate(BaseModel):
+    cluster_id: str
+    project_id: str | None = None
+    name: str
+    kind: str = "bridge"
+    vlan_id: int | None = None
+    mtu: int = 1500
+    gateway: str | None = None
+    dns: list[str] = []
+    dhcp_enabled: bool = False
+    tags: list[str] = []
+    description: str | None = None
+
+
+class SubnetCreate(BaseModel):
+    network_id: str
+    cidr: str
+    gateway: str | None = None
+    dns: list[str] = []
+    dhcp_enabled: bool = False
+
+
 class SecurityGroupCreate(BaseModel):
     project_id: str | None = None
     name: str
     description: str | None = None
 
 
+class SecurityRuleCreate(BaseModel):
+    security_group_id: str
+    direction: str = "ingress"
+    action: str = "allow"
+    protocol: str = "tcp"
+    source: str = "any"
+    destination: str = "any"
+    port: str | None = None
+    priority: int = 1000
+    logging: bool = False
+    description: str | None = None
+
+
 class PolicyCreate(BaseModel):
     project_id: str | None = None
     name: str
@@ -54,6 +119,20 @@ class IpReservationCreate(BaseModel):
     note: str | None = None
 
 
+class ServiceCatalogCreate(BaseModel):
+    name: str
+    protocol: str
+    ports: str
+    editable: bool = True
+
+
+class FirewallApplyRequest(BaseModel):
+    policy_id: str
+    cluster_id: str | None = None
+    confirm: bool = False
+    dry_run: bool = True
+
+
 class ClusterRead(OrmModel):
     id: str
     name: str
@@ -139,6 +218,20 @@ class SecurityGroupRead(OrmModel):
     description: str | None
 
 
+class SecurityRuleRead(OrmModel):
+    id: str
+    security_group_id: str
+    direction: str
+    action: str
+    protocol: str
+    source: str
+    destination: str
+    port: str | None
+    priority: int
+    logging: bool
+    description: str | None
+
+
 class PolicyRead(OrmModel):
     id: str
     project_id: str | None
@@ -149,6 +242,14 @@ class PolicyRead(OrmModel):
     last_compiled: dict[str, Any] | None
 
 
+class ServiceCatalogRead(OrmModel):
+    id: str
+    name: str
+    protocol: str
+    ports: str
+    editable: bool
+
+
 class FirewallPreview(BaseModel):
     policy_id: str
     dry_run: bool = True