Create load balancer

Provisions a new load balancer in the active scope from the load balancer creation wizard payload: LB name, VIP subnet and optional fixed VIP address (auto-allocated from the subnet when omitted), flavor (lb.small | lb.standard | lb.large), a first listener (protocol, port, TLS certificate for TERMINATED_HTTPS, connection limit), a first backend pool (protocol, algorithm, session persistence), initial members (address/port/weight) and an optional health monitor (type, delay, timeout, max retries, URL path, expected codes). On acceptance the resource appears in the scoped list with provisioning=PENDING_CREATE. Validation: name non-empty and unique within the scope (409); vipSubnet is the subnet's IDENTIFIER (UUID) — a subnet name is rejected up front with 422 VALIDATION_FAILED — and must reference an accessible subnet, and vipAddress, when given, must be a free address inside it (422 VALIDATION_FAILED / 404 for an unknown subnet); flavor must be a size the region offers (GET /regions/{region}/load-balancer-sizes) → 422 VALIDATION_FAILED on flavor otherwise; listener port 1-65535; tlsCertificate required when listener protocol is TERMINATED_HTTPS; monitor urlPath/expectedCodes only valid for HTTP/HTTPS monitor types. Async & state: Asynchronous — returns 202 with the LoadBalancer resource in provisioning=PENDING_CREATE, operating=OFFLINE. Terminal states: ACTIVE/ONLINE on success, ERROR on failure. resource.updated SSE frames (kind "network.load_balancer", patches to provisioning/operating) drive the UI refresh. Errors: 401 unauthenticated; 403 caller lacks contributor/owner/admin on the scope; 404 referenced VIP subnet or TLS certificate not found; 409 QUOTA_EXCEEDED when the scope's load-balancer quota is exhausted; 422 for any field validation failure; 500 on provisioning-control-plane failure. Idempotency/Concurrency: Idempotency-Key is required; replaying the same key returns the original 202 response without creating a duplicate LB.