Keep a load balancer's VIPs and backends in its own region #736

Summary

datum-cloud/enhancements#884 binds each network load balancer to one region in its first phase: traffic enters through that region's edge, and goes only to gVPC backends in that region. Global anycast across regions is #884's second phase.

Nothing enforces either half today:

• A NetworkRule can name a backend in another region. The gateway sends the traffic there over the SRv6 mesh.
• Gateway routes reach every site over the EVPN mesh. Unless the internet export is filtered by region, a VIP can be announced from a region that holds none of its backends.

The pools that give each VIP a region are #702. The region field on the tenant-facing resource is #696.

Acceptance criteria

• Admission refuses a NetworkRule with a backend outside the load balancer's region, and says which backend
• A VIP is exported to the internet only from its own region's edge
• The lab check from Run galactic-gateway in the containerlab lab with an end-to-end VIP check #699 also confirms a VIP isn't reachable through another site

Phase 1 of #698. Depends on #702 and #366.