Provider-neutral network/IPAM/firewall model (Network, Subnet, IpAllocation, FirewallRule) — real IPv4 CIDR-based address allocation, network-scoped subnet-overlap rejection, and a firewall rule catalog with no provider enforcement yet (modeled only, same status as Proxmox LXC/Incus networks elsewhere in this SDK). Pure Java, no framework dependencies.