feat(cli): wire sunbeam-net into sunbeam connect/disconnect/vpn

Adds the foreground VPN client commands. The daemon runs in-process
inside the CLI for the lifetime of `sunbeam connect` — no separate
background daemon yet, that can come later if needed.

- Cargo.toml: add sunbeam-net as a workspace dep, plus hostname/whoami
  for building a per-machine netmap label like "sienna@laptop"
- src/config.rs: new `vpn-url` and `vpn-auth-key` fields on Context
- src/cli.rs: `Connect`, `Disconnect`, and `Vpn { Status }` verbs
- src/vpn_cmds.rs: command handlers
  - cmd_connect reads VPN config from the active context, starts the
    daemon at ~/.sunbeam/vpn, polls for Running, then blocks on ^C
    before calling DaemonHandle::shutdown
  - cmd_disconnect / cmd_vpn_status are placeholders that report based
    on the control socket; actually talking to a backgrounded daemon
    needs an IPC client (not yet exposed from sunbeam-net)
- src/workflows/mod.rs: `..Default::default()` on Context literals so
  the new fields don't break the existing tests

Cargo.toml

@@ -15,6 +15,10 @@ members = ["sunbeam-sdk", "sunbeam-net"]
 resolver = "3"
 
 [dependencies]
+# Workspace
+sunbeam-sdk = { path = "sunbeam-sdk" }
+sunbeam-net = { path = "sunbeam-net" }
+
 # Core
 thiserror = "2"
 tokio = { version = "1", features = ["full"] }
@@ -78,6 +82,8 @@ wfe-core = { version = "1.6.3", registry = "sunbeam", features = ["test-support"
 wfe-sqlite = { version = "1.6.3", registry = "sunbeam" }
 wfe-yaml = { version = "1.6.3", registry = "sunbeam" }
 async-trait = "0.1"
+hostname = "0.4.2"
+whoami = "2.1.1"
 
 [dev-dependencies]
 wiremock = "0.6"