Attach router interface

Attaches a new internal interface to the router (the "Add interface" action and inline draft row on the Interfaces tab of the router detail page). The caller supplies the target subnet, optionally the owning network (defaulted to the subnet's network when omitted) and a fixedIp (auto-assigned from the subnet when omitted). On acceptance the interface appears in the router's Interfaces tab and the subnet's traffic is routed through this router; the interface id is generated by the backend. Validation: router must exist and be visible in scope → 404 NOT_FOUND; subnet is required and must reference an accessible subnet in the scope → 422 VALIDATION_FAILED when missing/blank, 404 when the subnet or network reference is unknown; fixedIp, when supplied, must be a valid address inside the subnet CIDR and not already in use → 422 on malformed/out-of-range, 409 CONFLICT when the address is taken or the subnet is already attached to this router. Async & state: Asynchronous — returns 202 with the RouterInterface in its transitional DOWN state while the port is wired; a resource.updated SSE frame with kind: network.router patches the interface entry to terminal ACTIVE on success, or leaves it DOWN with the failure reported on the parent router activity. Errors: 401 unauthenticated; 403 caller lacks contributor/owner/admin rights; 404 unknown router, subnet, or network; 409 subnet already attached to the router or fixed IP already allocated; 422 missing subnet or malformed fixed IP; 500 internal failure. Idempotency/Concurrency: Idempotency-Key is required; replaying the same key returns the original 202 response with the same interface id instead of attaching a duplicate port — duplicate creation here would be harmful, so retries are made safe.