feat(net): derive cluster API target from netmap by hostname

Adds an optional `cluster_api_host` field to VpnConfig. When set, the
daemon resolves it against the netmap's peer list once the first
netmap arrives and uses that peer's tailnet IP as the proxy backend,
overriding the static `cluster_api_addr`. Falls back to the static
addr if the hostname doesn't match any peer.

The resolver tries hostname first, then peer name (FQDN), then a
prefix match against name. Picks v4 over v6 from the peer's address
list.

- sunbeam-net/src/config.rs: new `cluster_api_host: Option<String>`
- sunbeam-net/src/daemon/lifecycle.rs: resolve_peer_ip helper +
  resolution at proxy bind time
- sunbeam-net/tests/integration.rs: pass cluster_api_host: None in
  the existing VpnConfig literals
- src/config.rs: new context field `vpn-cluster-host`
- src/vpn_cmds.rs: thread it from context → VpnConfig

src/vpn_cmds.rs

@@ -171,11 +171,19 @@ async fn run_daemon_foreground() -> Result<()> {
         state_dir: state_dir.clone(),
         // Bind the local k8s proxy on 16579 — far enough away from common
         // conflicts (6443 = kube API, 16443 = sienna's SSH tunnel) that we
-        // shouldn't collide on dev machines. TODO: make this configurable
-        // and discoverable via IPC.
+        // shouldn't collide on dev machines. TODO: make this configurable.
         proxy_bind: "127.0.0.1:16579".parse().expect("static addr"),
+        // Static fallback if the netmap doesn't have the named host.
         cluster_api_addr: "100.64.0.1".parse().expect("static addr"),
         cluster_api_port: 6443,
+        // If the user set vpn-cluster-host in their context config, the
+        // daemon resolves it from the netmap and uses that peer's
+        // tailnet IP for the proxy backend.
+        cluster_api_host: if ctx.vpn_cluster_host.is_empty() {
+            None
+        } else {
+            Some(ctx.vpn_cluster_host.clone())
+        },
         control_socket: state_dir.join("daemon.sock"),
         hostname,
         server_public_key: None,