feat: add IPsec tunnel CRUD commands

[cdot65]

Overview

The CLI has no scm set/show/delete/backup/load network ipsec-tunnel commands despite the SDK (scm.config.network.ipsec_tunnel, scm.models.network.ipsec_tunnel) fully supporting IPsec tunnel CRUD. This blocks the service connection workflow — scm set sase service-connection --ipsec-tunnel <name> requires a valid tunnel reference, but users can't create one through the CLI.

Context

• SDK module: scm.config.network.ipsec_tunnel (class IPsecTunnel)
• SDK model: scm.models.network.ipsec_tunnel (IPsecTunnelCreateModel)
• The CLI already has IKE gateway (ike-gateway) and IPsec crypto profile (ipsec-crypto-profile) commands in network.py
• IPsec tunnels reference IKE gateways + IPsec crypto profiles via auto_key config
• Discovered while attempting to create a service connection end-to-end via CLI

Impact

Service connection creation is broken without this. Users must drop to raw Python SDK calls to create IPsec tunnels before they can use scm set sase service-connection.

Scope

• In scope: Full CRUD commands: set, show, delete, backup, load for ipsec-tunnel in network.py
• In scope: SDK client methods in sdk_client.py
• In scope: Validator model in validators.py
• In scope: Documentation page at docs/cli/network/ipsec-tunnel.md
• Out of scope: Changes to service connection commands

Acceptance Criteria

• scm set network ipsec-tunnel creates/updates tunnels with auto_key (IKE gateway ref + IPsec crypto profile)
• scm show network ipsec-tunnel lists/shows tunnel configs
• scm delete network ipsec-tunnel deletes tunnels
• scm backup network ipsec-tunnel exports to YAML
• scm load network ipsec-tunnel imports from YAML
• Unit tests for all new commands
• Documentation page created
• End-to-end: IKE GW -> IPsec tunnel -> service connection workflow works entirely via CLI

Implementation Plan

1. Add IPsecTunnel validator model to validators.py based on SDK schema
2. Add CRUD methods to sdk_client.py (create_ipsec_tunnel, get_ipsec_tunnel, list_ipsec_tunnels, delete_ipsec_tunnel)
3. Add commands to network.py following existing ike-gateway patterns
4. Register in main.py
5. Add tests
6. Add docs page