[SaladDay]

Adds a Network section to Settings → Sandbox and scheduling with Allow public internet and Extra allowed domains.

• Domains are validated while typing with the generated deployment contract rule; inline errors cover pattern, length, count, lowercase and duplicates.
• The switch is disabled when the Provider cannot restrict traffic; the domain list is disabled when it cannot reach a private network. The reason is in the HelpTip.
• Save goes through the existing deployment write and shows "New sandboxes will run with this policy".
• English and zh-CN strings, configuration reference rows (EN and zh), a vitest and Playwright specs.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}