feat: L4 load balancer with nftables DNAT

[Frando]

Adds L4 load balancing to routers using nftables DNAT, matching kube-proxy nftables mode behavior. A balancer creates a virtual IP on a router that distributes incoming connections across backend devices using round-robin or random selection.

The implementation lives in a self-contained balancer.rs module (~500 LOC) following the split-impl pattern. Router and RouterBuilder methods are defined inside balancer.rs via split impl blocks. The glue outside the module is ~10 lines total: one field on RouterData, one setup call in wiring.rs, and re-exports in lib.rs.

Under the hood, each balancer generates a table ip lb with per-balancer chains using numgen inc mod N (round-robin) or numgen random mod N (random). Session affinity uses nftables dynamic maps with configurable timeouts. A postrouting masquerade rule handles same-subnet return traffic so backends reply through the router's conntrack rather than directly to the client at L2.

let dc = lab.add_router("dc").build().await?;
let web1 = lab.add_device("web1").iface("eth0", dc.id()).build().await?;
let web2 = lab.add_device("web2").iface("eth0", dc.id()).build().await?;

dc.add_balancer(
    BalancerConfig::new("web", "198.18.1.100".parse()?, 80)
        .backend(web1.id(), 8080)
        .backend(web2.id(), 8080)
        .round_robin(),
).await?;

// Dynamic backend management (rolling updates)
dc.remove_lb_backend("web", web1.id()).await?;
dc.add_lb_backend("web", web3.id(), 8080).await?;

Supports TCP, UDP, and both. Conntrack flush is best-effort (works when conntrack binary is available, silently skips otherwise). 7 tests cover round-robin distribution, backend add/remove, and UDP balancing.