refactor(network): stop managing forwarding and RA

[LucaLin233]

Summary

• Remove IPv4/IPv6 forwarding and RA assignments, virtual-interface RA normalization, and per-interface forwarding snapshots from network-optimize.sh.
• Keep forwarding/RA visible as unmanaged, read-only status; preserve legacy config/runtime backups and explicit restore previous rollback behavior.
• Harden initcwnd ownership markers, BBR persistence, rollback failure reporting, Cloudflare curl reaping, and per-egress qdisc/tcshape detection.
• Document reboot-time forwarding ownership and migration risk.

Migration

A managed legacy config containing forwarding/RA keys prints one warning during install. New installs replace the managed config without writing retired runtime keys, so current forwarding/RA values remain unchanged until reboot or another manager takes over.

Validation

• bash -n modules/network-optimize.sh
• shellcheck --severity=warning modules/network-optimize.sh
• bash tests/test-network-optimize.sh
• bash tests/test-network-optimize-entry.sh
• bash tests/test-network-optimize-verify.sh
• bash tests/run.sh
• forwarding/RA assignment and sysctl -w greps return no matches

Risk

After reboot, Docker, NAT, VPN, Tailscale exit-node, WireGuard routing, or IPv6 routing deployments must enable forwarding through their owning component or another sysctl config. This change does not automatically alter current production runtime values.