Add VM/LXC ticket presets, internal-ticket NICs, and access cards

Summary

• Internal-ticket support: model.ProvisionRequest gains a Kind/Pool/FreeName/NICs branch (selected when ClientID == 0), validated by model.Validate, applied via generic multi-NIC device/interface creation in ticket_apply.go.
• Presets: Settings > Presets (/settings/presets) lets operators save reusable VM/LXC shapes (kind, pool, ISO, CPU/RAM/disk, NICs) that prefill the new /tickets/new operator-facing ticket form (client or internal mode), via a shared repeatable-NIC-row widget (static/nic_rows.js).
• Access cards: per-VM Proxmox vmuser<client_id>@pve account creation/ACL grant from the device page, so a client can be handed direct VM console access without an operator manually running Proxmox API calls.

Corrections to the approved spec

• Pool/VSwitch are free text, not live dropdowns — ticket-creation time has no resolved Proxmox environment yet to validate them against, so both are operator/preset-typed strings rather than API-backed pickers.
• Presets ship unseeded, not migration-seeded — Settings > Presets starts empty; the README documents two example presets (Client VM, Klab) for the operator to add by hand rather than baking them into a migration.

Test plan

• go build ./..., go vet ./..., go test ./... all pass.
• Manual smoke test of /tickets/new (preset prefill, internal + client ticket creation) — not run in this session (no browser tooling available); needs operator verification before merge.