fix(enrollment): filter Docker bridge IPs and add report_interface/report_ip config

- identity.rs: filter 172.16.0.0/12 (Docker bridge) and 169.254.0.0/16 (link-local)
  from get_ip_addresses() auto-detection
- identity.rs: add is_container_bridge(), is_link_local(),
  get_ip_for_interface(), get_primary_ip() functions
- client.rs: add report_interface/report_ip fields to EnrollmentClient,
  new with_ip_overrides() constructor, register() uses get_primary_ip()
- loader.rs: add report_interface/report_ip to EnrollmentConfig
- mod.rs: wire config overrides through to EnrollmentClient
- config.yaml.example: document new report_interface/report_ip options
- Tests: add 18 new bridge filtering/IP override tests, fix Docker
  container compatibility in existing tests

configs/config.yaml.example

@@ -57,3 +57,11 @@ package_manager:
 #   # Maximum number of polling attempts before giving up
 #   # Default: 1440 (24 hours at 60s intervals = 86400 seconds total)
 #   max_poll_attempts: 1440
+#   # Network interface whose IPv4 address is reported to the manager.
+#   # Overrides auto-detection when the wrong IP is selected (e.g., Docker bridge).
+#   # Example: "eth0", "ens192", "enp0s3"
+#   report_interface: "eth0"
+#   # Explicit IPv4 address reported to the manager.
+#   # Highest priority — overrides both report_interface and auto-detect.
+#   # Useful when the host has multiple IPs or runs inside a container.
+#   report_ip: "192.168.3.36"