activator/client/controller: use DzPrefixFirstIP as multicast tunnel endpoint

[martinsander00]

Resolves: malbeclabs/infra#522

Summary

• Multicast tunnels now use the device's DZ prefix first IP (network address of dz_prefixes[0]) as both tunnel source (device side) and tunnel destination (client side), instead of the device's public IP — enabling simultaneous IBRL and multicast tunnels on the same device with unique GRE (src, dst) pairs
• Client sets multicast tunnel_endpoint to DzPrefixFirstIP; when IBRL already exists, multicast reuses the same device instead of excluding it
• Activator validates DzPrefixFirstIP as a valid tunnel endpoint and explicitly reserves the network address of each dz_prefix block so it cannot be allocated as a user dz_ip
• E2E infrastructure configures DzPrefixFirstIP as a secondary IP on device Ethernet1; single-client tests now verify same-device IBRL+multicast coexistence

Backward Compatibility

• Standalone multicast (no IBRL) with DzPrefixFirstIP available: uses DzPrefixFirstIP
• Standalone multicast on old devices without dz_prefixes: falls back to PublicIP
• Controller logic unchanged — already uses user.TunnelEndpoint when set, falling back to PublicIP

Testing Verification

• Activator unit tests (55 pass): test_is_valid_tunnel_endpoint_matches_dz_prefix, test_dz_prefix_first_ip_reserved_at_init, updated IP count expectations for reservation
• Client unit tests (62 pass): multicast tests updated for same-device behavior with DzPrefixFirstIP, IBRL+multicast coexistence on same device
• Controller unit tests (6 pass): multicast_uses_dz_prefix_first_ip_as_tunnel_source verifying UnderlaySrcIP matches DzPrefixFirstIP
• E2E: TestE2E_Multicast, TestE2E_IBRL_Multicast_Coexistence, TestE2E_MultiTunnel_SameDevice

## Devnet Verification (chi-dn-dzd1 + chi-dn-bm2)                                                                                                                                            
                                                                                                                                                                                               
  ### Device onchain state                                                                                                                                                                     
  $ doublezero device list   
   code        | public_ip | dz_prefixes
   chi-dn-dzd1 | 100.0.0.1 | 198.18.0.0/24

  ### Client: both tunnels up on same device
  $ doublezero status
   Tunnel Status  | Tunnel Name | Tunnel Src      | Tunnel Dst | User Type | Current Device
   BGP Session Up | doublezero0 | 137.174.145.145 | 100.0.0.1  | IBRL      | chi-dn-dzd1
   BGP Session Up | doublezero1 | 137.174.145.145 | 198.18.0.0 | Multicast | chi-dn-dzd1

  ### Device: distinct GRE (src, dst) pairs — no demux collision
  chi-dn-dzd1# show running-config section Tunnel50
  interface Tunnel501
     description USER-MCAST-501
     tunnel source 198.18.0.0        ← DzPrefixFirstIP
     tunnel destination 137.174.145.145

  interface Tunnel502
     description USER-UCAST-502
     tunnel source 100.0.0.1         ← public_ip
     tunnel destination 137.174.145.145

  ### PIM adjacency established over multicast tunnel
  chi-dn-dzd1# show ip pim neighbor
  Neighbor Address  Interface     Uptime
  169.254.0.1       Tunnel501     00:08:10