Add a subnet to a virtual network

Creates a subnet inside the given virtual network from the inline "Add subnet" draft row in the network detail page (fields: name, CIDR, optional gateway). The backend allocates the DHCP pool, derives the gateway when omitted (first usable host), enables DHCP by default, and the subnet immediately appears in the network's subnet table with its available-IP capacity computed from the CIDR mask. Validation: name is required and must be unique within the network else 422 VALIDATION_FAILED / 409 CONFLICT; cidr must parse, be contained within the network's address space, and not overlap any existing subnet — containment/overlap violations map to 409 CONFLICT, parse failures to 422; gateway when supplied must be an IP inside the subnet CIDR else 422; unknown networkId maps to 404 NOT_FOUND; exceeding the per-network subnet quota maps to 409 QUOTA_EXCEEDED. Async & state: Synchronous (201): subnet allocation is a fast control-plane write and the full Subnet resource is returned immediately. A resource.updated SSE frame for the parent network (kind: network, patch: {subnets}) notifies other sessions; no transitional state exists on the subnet itself. Errors: 401 unauthenticated; 403 caller lacks contributor rights in the scope; 404 unknown networkId; 409 CONFLICT on duplicate name or CIDR overlap; 409 QUOTA_EXCEEDED on subnet quota; 422 on malformed name/cidr/gateway; 500 on allocation failure. Idempotency/Concurrency: Idempotency-Key is optional (recommended); a replay with the same key returns the originally created subnet (same id) instead of allocating a second overlapping range.