feat(catalog): topology layer — image layer, box templates, subnet layouts, network policies

[t0kubetsu]

Context

range42-playbooks (feat/r42playbooks-generator) introduces the r42playbooks scenario generator, which reads structured descriptors from the catalog to allocate VMs, assign IPs, and resolve Ansible roles and attachments. This issue tracks the catalog-side additions required to make that generator work end-to-end.

What this adds

01_image_layer/

Cloud image descriptors for the two supported distros:

• ubuntu_noble/v1.0.0/ — 12 proxmox_templates, cloud_image download spec
• debian_trixie/v1.0.0/ — 2 proxmox_templates, cloud_image download spec

VM names follow the template-vm-{distro}-{codename}-* convention for global uniqueness across a Proxmox node.

05_topology_layer/

Structured YAML descriptors consumed directly by r42playbooks:

• box_templates — admin-wazuh, debian-jump, deployer, student-box, vuln-box: each carries template_vm, image, firewall_rules, and attachments (docker stacks, ansible roles)
• subnet_layouts — default-3zone, dual-lan: define subnets with name, cidr, bridge, section/label metadata, and a template_subnet for image-layer VMs
• network_policies — dual-lan-isolate: deny-by-default inter-subnet policy with explicit egress rules, rendered as iptables R42-FORWARD chain rules

Roles

• 02_ansible_layer/linux/debian-based/ — renamed from ubuntu/; when conditions and Docker repo URLs updated to cover both Ubuntu and Debian

Dependency

This PR must be reviewed and merged in coordination with range42-playbooks PR for feat/r42playbooks-generator — the generator expects the exact catalog shape defined here.