feat: add network: endpoint resolver, VM.Config.Options privilege requirement, top talkers dashboard widget, and automatic guest firewall enablement

Add network: prefix support in endpoint_values to resolve network names to IPAM subnet CIDRs for policy matching, extend workload_provider_target to accept vmid: prefix and bare workload names as fallback resolution methods, implement dashboard_top_talkers to aggregate traffic flows by workload with interface_traffic fallback when flows unavailable, add

backend/tests/test_proxmox_provider.py

@@ -19,6 +19,8 @@ class FakeResponse:
 class FakeAsyncClient:
     deleted_urls: list[str] = []
     posted_payloads: list[dict] = []
+    put_urls: list[str] = []
+    put_payloads: list[dict] = []
 
     def __init__(self, **_: object) -> None:
         return None
@@ -41,6 +43,11 @@ class FakeAsyncClient:
         self.deleted_urls.append(url)
         return FakeResponse(None)
 
+    async def put(self, url: str, data: dict, **__: object) -> FakeResponse:
+        self.put_urls.append(url)
+        self.put_payloads.append(data)
+        return FakeResponse(None)
+
     async def post(self, _: str, data: dict, **__: object) -> FakeResponse:
         self.posted_payloads.append(data)
         return FakeResponse({"pos": 1})
@@ -50,6 +57,8 @@ class FakeAsyncClient:
 async def test_apply_rules_replaces_only_marked_nexafabric_rules(monkeypatch: pytest.MonkeyPatch) -> None:
     FakeAsyncClient.deleted_urls = []
     FakeAsyncClient.posted_payloads = []
+    FakeAsyncClient.put_urls = []
+    FakeAsyncClient.put_payloads = []
     monkeypatch.setattr(proxmox.httpx, "AsyncClient", FakeAsyncClient)
 
     result = await ProxmoxProvider().apply_rules(
@@ -74,6 +83,8 @@ async def test_apply_rules_replaces_only_marked_nexafabric_rules(monkeypatch: py
     assert result["applied"] is True
     assert result["rules_deleted"] == 1
     assert FakeAsyncClient.deleted_urls == ["https://pve.example:8006/api2/json/nodes/pve1/qemu/100/firewall/rules/1"]
+    assert FakeAsyncClient.put_urls == ["https://pve.example:8006/api2/json/nodes/pve1/qemu/100/firewall/options"]
+    assert FakeAsyncClient.put_payloads == [{"enable": 1}]
     assert FakeAsyncClient.posted_payloads == [
         {
             "type": "in",