Re-architect NetBox IP consumption per review comment 898: the deploy must
not (re)create NetBox infrastructure, must interface through TF rather than
shell scripts in `hosts-common.nix`, and must work for both incus effects
(`tf-incus-hosts` and `tf-incus-operator-hosts`).

Allocation now lives in the incus graph (`tf/incus/{hosts,operator}/netbox.tf`):
each `needs_public_ip` node gets a `netbox_virtual_machine` + interface and a
`netbox_available_ip_address` (v4, plus v6 when the pool has a v6 prefix), read
from an owner-provisioned PREFIX the deploy only reads. The prefix is discovered
by a selector (`netbox_prefix_selector`, default `tag:fediversity-operator`)
matched via the generic `netbox_prefixes` filter -- so the deploy needs no
specific knowledge of what subnets the NetBox has, and the hosting provider can
renumber or grow the pool freely; a `cidr:` selector pins an exact subnet when
wanted. The allocated address rides into each node's `networking` config via the
existing `NETBOX_NODE_IPS` channel, passed through the `local-exec` environment
in the one deploy apply. Release is automatic on `tofu destroy`.

This drops the entire shell-wrapper machinery from `hosts-common.nix`
(`mkNetboxAllocFragment`, the per-node/aggregate/per-verb run+destroy wrappers,
the `netbox` model submodule, and the seed/perApp assembly) -- ~330 lines -- in
favour of threading a small `netbox` option (cluster name + prefix selector) and
a per-node `needsPublicIp` flag into the incus effect. The `netboxArgs` env
reads collapse to a single `NETBOX_PREFIX_SELECTOR` (`<kind>:<value>`). An
operator deploy no longer seeds ranges, and a deploy with no public node reads
no NetBox at all (the data sources are count-gated).

The `apps-tf-incus` test now seeds a tagged v4+v6 prefix once as init (it owns
its NetBox), then the deploy allocates from it in-graph; assertions keep the
eth0-carries-v4+v6, idempotent-re-deploy, distinct-address, internal-node-skip,
and destroy-releases coverage, reading allocations back over the NetBox REST API
(`netbox_vm_ips`) rather than driving a standalone `get-ip`. A new
`tf-netbox-store-prefix` effect seeds the tagged prefix. The standalone
`get-ip`/`store-ips` effects and `test-netbox-service` are unchanged (they still
unit-test the plumbing).

Assisted-by: Claude:claude-opus-4-8

@@ -154,0 +177,4 @@
+    "netbox"
+    "terraform-backend"
+    "valkey"
+    "postgresql"

@@ -109,0 +123,4 @@
+    "valkey"
+    "postgresql"
+    "smtp"
+  ];

@@ -102,0 +118,4 @@
+                mergeNode =
+                  node: env:
+                  let
+                    ips = nodeIps.''${node} or null;

@@ -411,0 +499,4 @@
+                      apps = publicNodes;
+                      outFile = "\"$tmp/node-ips.json\"";
+                    }}
+                    NETBOX_NODE_IPS="$(cat "$tmp/node-ips.json")"

@@ -368,0 +419,4 @@
+
+      node_ips='{}'
+      ${lib.concatMapStringsSep "\n" (app: ''
+        alloc="$("${lib.getExe netboxCfg.perApp.${app}.allocate}")"

@@ -411,0 +510,4 @@
+                  done
+
+                  jq -s 'reduce .[] as $x ({}; . * $x)' "$tmp/alloc.json" "$tmp/main.json"
+                '';