fix(enrollment): filter Docker bridge IPs and add report_interface/report_ip config

- identity.rs: filter 172.16.0.0/12 (Docker bridge) and 169.254.0.0/16 (link-local)
  from get_ip_addresses() auto-detection
- identity.rs: add is_container_bridge(), is_link_local(),
  get_ip_for_interface(), get_primary_ip() functions
- client.rs: add report_interface/report_ip fields to EnrollmentClient,
  new with_ip_overrides() constructor, register() uses get_primary_ip()
- loader.rs: add report_interface/report_ip to EnrollmentConfig
- mod.rs: wire config overrides through to EnrollmentClient
- config.yaml.example: document new report_interface/report_ip options
- Tests: add 18 new bridge filtering/IP override tests, fix Docker
  container compatibility in existing tests

src/config/loader.rs

@@ -114,6 +114,14 @@ pub struct EnrollmentConfig {
     pub polling_interval_seconds: u64,
     #[serde(default = "default_max_poll_attempts")]
     pub max_poll_attempts: u32,
+    /// Network interface whose IPv4 address is reported to the manager.
+    /// Overrides auto-detection. Example: `"eth0"`, `"ens192"`.
+    #[serde(default)]
+    pub report_interface: Option<String>,
+    /// Explicit IPv4 address reported to the manager.
+    /// Highest priority — overrides both `report_interface` and auto-detect.
+    #[serde(default)]
+    pub report_ip: Option<String>,
 }
 
 fn default_polling_interval() -> u64 {