feat: add guest network autoconfiguration via Firecracker MMDS

Introduces optional per-clone IP assignment using the Firecracker Microvm
Metadata Service (MMDS). A background daemon (fc-net-init) is baked into
the rootfs during init and captured in the golden snapshot — on clone
resume it polls 169.254.169.254 and applies the IP/GW/DNS config injected
by the orchestrator immediately after snapshot restore.

- config.go: add AutoNetConfig bool (FC_AUTO_NET_CONFIG=1)
- orchestrator.go: embed fc-net-init daemon + MMDS link-local route in
  init script; set AllowMMDS: true on golden NIC; spawnOne/SpawnSingle
  accept net bool and propagate it via FC_AUTO_NET_CONFIG in proxy env
- console.go: set AllowMMDS: true on clone NIC; call configureMmds()
  after m.Start() when AutoNetConfig is enabled
- network.go: add configureMmds() — PUT /mmds with ip/gw/dns over the
  clone's Firecracker Unix socket
- serve.go: POST /clones accepts optional {"net": bool} body to override
  the global AutoNetConfig default per-request
- web/terminal.html: spawn button always sends {"net": true}
- docs/commands.md: document manual config + MMDS autoconfiguration

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

orchestrator/serve.go

@@ -53,7 +53,19 @@ func Serve(orch *Orchestrator, addr string) error {
 			w.Header().Set("Content-Type", "application/json")
 			json.NewEncoder(w).Encode(ids) //nolint:errcheck
 		case http.MethodPost:
-			id, err := orch.SpawnSingle()
+			// Optional JSON body: {"net": bool}
+			// Defaults to the server's FC_AUTO_NET_CONFIG setting.
+			var req struct {
+				Net *bool `json:"net"`
+			}
+			if r.ContentLength > 0 {
+				json.NewDecoder(r.Body).Decode(&req) //nolint:errcheck
+			}
+			net := orch.cfg.AutoNetConfig
+			if req.Net != nil {
+				net = *req.Net
+			}
+			id, err := orch.SpawnSingle(net)
 			if err != nil {
 				http.Error(w, err.Error(), http.StatusInternalServerError)
 				return