Fix LXC creation/networking bugs (#1, #2, #3, #4, #5)

Closes #1 (closed), #2 (closed), #3 (closed), #4 (closed), #5 (closed)

Summary

Fixes all five open issues, mostly encountered while creating/managing LXC containers:

• #4 (closed) LXC: Created unpliveleged — every LXC Rax creates is now privileged (unprivileged=0) instead of unprivileged.
• #5 (closed) LXC: No password and key — a freshly created container gets a randomly generated root password (24 chars, no ambiguous characters, shown once on the Apply result — Rax never stores it) plus, optionally, SSH public keys from a new global Settings > LXC SSH Keys page, pushed to ssh-public-keys. Updating the key list stages a set_ssh_keys action per device rather than pushing to live containers automatically — always an explicit Apply.
• #2 (closed) LXC changing ip and pool ... updates in NB, but not Proxmox — diff.Compute now also compares an LXC interface's declared IPv4/IPv6 address and gateway against what's actually live on the container's netN config (previously only bridge/VLAN/MAC were compared), so a changed IP now produces an update_nic action that reaches Proxmox instead of only ever writing NetBox. The pool-move code was already correct on inspection, so it's untouched.
• #3 (closed) Validate IPs — the "Add IP" form now rejects malformed CIDR input server-side (net.ParseCIDR), closing the reported 2602;f72e:a::111/122 case. The next-free-IP suggestion is also now resolved per interface: each interface's own VLAN-tied NetBox prefix is tried first, falling back to the existing pool-wide store.PoolRange only when NetBox has no prefix for that VLAN — two interfaces on one device can sit on different subnets, so a single device-wide suggestion was wrong for at least one of them.
• #1 (closed) Do Deamon/SystemD Unit — added rax.service.example plus a README section for running Rax as a bare-metal systemd service instead of via Docker.

Test plan

• go build ./...
• go vet ./...
• gofmt -l . (clean)
• go test ./... -count=1 — new unit tests for the IP/gateway diff comparison, SSH key generation/config dispatch, LXC SSH key store CRUD + settings page, CIDR validation, VLAN-based/pool-fallback IP suggestion, plus end-to-end web tests (create shows the one-time password page, IP change reaches an update_nic action, malformed CIDR rejected, VLAN suggestion wins over pool).