feat: add network: endpoint resolver, VM.Config.Options privilege requirement, top talkers dashboard widget, and automatic guest firewall enablement

Add network: prefix support in endpoint_values to resolve network names to IPAM subnet CIDRs for policy matching, extend workload_provider_target to accept vmid: prefix and bare workload names as fallback resolution methods, implement dashboard_top_talkers to aggregate traffic flows by workload with interface_traffic fallback when flows unavailable, add

backend/app/services/providers/proxmox.py

@@ -133,6 +133,12 @@ class ProxmoxProvider(Provider):
         vmid = target["vmid"]
         return f"{connection.api_url.rstrip('/')}/api2/json/nodes/{node}/{kind}/{vmid}/firewall/rules"
 
+    def firewall_options_url(self, connection: ProviderConnection, target: dict[str, Any]) -> str:
+        kind = "lxc" if target.get("kind") == "lxc" else "qemu"
+        node = target["node"]
+        vmid = target["vmid"]
+        return f"{connection.api_url.rstrip('/')}/api2/json/nodes/{node}/{kind}/{vmid}/firewall/options"
+
     def policy_marker(self, rule: dict[str, Any]) -> str:
         return f"NexaFabric policy={rule.get('policy_id')}"
 
@@ -156,6 +162,17 @@ class ProxmoxProvider(Provider):
                 deletions.append({"pos": pos, "comment": comment})
         return deletions
 
+    async def enable_guest_firewall(
+        self,
+        client: httpx.AsyncClient,
+        headers: dict[str, str],
+        connection: ProviderConnection,
+        target: dict[str, Any],
+    ) -> dict[str, Any]:
+        response = await client.put(self.firewall_options_url(connection, target), headers=headers, data={"enable": 1})
+        response.raise_for_status()
+        return response.json().get("data")
+
     async def apply_rules(self, connection: ProviderConnection, rules: list[dict[str, Any]]) -> dict[str, Any]:
         if connection.read_only:
             return {"applied": False, "reason": "Cluster is read-only", "rules": rules}
@@ -177,6 +194,7 @@ class ProxmoxProvider(Provider):
 
         applied_rules = []
         deleted_rules = []
+        enabled_targets = []
         audit_only_rules = []
         async with httpx.AsyncClient(verify=connection.verify_tls, timeout=20) as client:
             for target_rules in grouped.values():
@@ -184,6 +202,8 @@ class ProxmoxProvider(Provider):
                 rules_url = self.firewall_rules_url(connection, target)
                 marker = self.policy_marker(target_rules[0])
                 deleted_rules.extend(await self.delete_existing_policy_rules(client, headers, rules_url, marker))
+                if any(not rule.get("audit_only") for rule in target_rules):
+                    enabled_targets.append({"target": target, "result": await self.enable_guest_firewall(client, headers, connection, target)})
 
                 for rule in target_rules:
                     if rule.get("audit_only"):
@@ -210,6 +230,7 @@ class ProxmoxProvider(Provider):
             "applied": True,
             "rules_written": len(applied_rules),
             "rules_deleted": len(deleted_rules),
+            "firewall_enabled": enabled_targets,
             "audit_only": audit_only_rules,
             "rules": applied_rules,
         }