Add network_firewall_enabled_value helper to parse and inject firewall=1 into Proxmox network interface config strings, implement enable_guest_firewall_interfaces to update VM/LXC config with firewall=1 on all netX interfaces before writing rules, extend workload_config_url to build config endpoint paths for qemu/lxc guests, add interfaces_enabled field to apply_rules response showing which interfaces were
Add network: prefix support in endpoint_values to resolve network names to IPAM subnet CIDRs for policy matching, extend workload_provider_target to accept vmid: prefix and bare workload names as fallback resolution methods, implement dashboard_top_talkers to aggregate traffic flows by workload with interface_traffic fallback when flows unavailable, add
Add minimum write privileges section covering VM.Audit and VM.Config.Network requirements for firewall orchestration, document NexaFabric comment marker approach for safe rule replacement, clarify that only VM/LXC-level rules with concrete workload targets are supported for live apply while security groups remain preview-only, add firewall interface checkbox requirement for enforcement, document