feat: Multi-WAN Network visibility (read-only)

[ultimaterex]

Summary

• Enrich Network WAN with ready status, dual_wan / conn_check chips, virtWanGroups strip (failback/strictVPN), and last-test when present — no UI redesign
• Parse Multi-WAN fields from fw-app init into ObservatorySnapshot; attach on GET /v1/network with capabilities.writes: false (no mutate handlers)
• Hermetic fixtures for virtWanGroups / wanTestResult / Digicel·Telesur ISP label regression

Type of change

• New feature
• Docs

✅ Required (must be checked to merge)

• I have read the CONTRIBUTING.md.
• I have read and agree to the Contributor License Agreement (CLA).

Checklist

• My changes build: go vet ./... and gofmt -l . are clean (and npm run build for UI changes).
• Tests pass: go test fireproxy/pkg/... fireproxy/agent/... fireproxy/server/....
• I added or updated tests for behavior changes, and they are hermetic (no reliance on real host state, network, or /sys).
• No secrets or real network data are committed (no tokens, .env, live dumps, or real MAC/IP/SSID values — use sanitized fixtures).
• I updated relevant docs (README / docs/) if behavior, config, or the API changed.
• The change is focused and reasonably scoped for review.

Notes for reviewers

• Spec/plan: docs/superpowers/specs/2026-08-26-multi-wan-design.md, docs/superpowers/plans/2026-08-26-multi-wan.md
• Prefer-WAN / failback / enable-dual_wan writes deferred until lab-proven cmds (follow-up spec)
• Out of scope: Inventory Multi-WAN panel, networkConfig DHCP/LAN, speedtest, liveStats

Test plan

• cd server && go test ./internal/fwapp/ ./internal/api/ ./internal/observatory/ -count=1
• Network tab: WAN rows show ready/not ready; Failover chip unchanged
• With fw-app init: dual_wan / conn_check chips; Proton Miami virt strip when present
• Empty wanTestResult: no false last-test failure
• Digicel/Telesur labels unchanged on Metrics/Network
• Anonymity mode: virt group names anonymized