feat(console): reach a maintenance node with no DHCP server

[Bugs5382]

What and why

I want a maintenance node to stay reachable when the provisioning network has no DHCP server, so a laptop cabled straight to it works with no server-side config.

The premise in the issue turned out to be only half right: nothing on the node assigned an IPv4 link-local address. The kernel only does ip=dhcp, and when no server answers it gives up and leaves the interfaces down with no address. So this change adds the address as well as showing it:

• Link-local fallback (init): maintenance and reprovision mode run a loop (every 2 s) that, while no interface holds a reachable IPv4 address, brings Ethernet links up and gives the first one with carrier an RFC 3927 address in 169.254.0.0/16. The address is derived from the MAC (RFC 3927 2.1), so it is stable across boots. Only one interface gets one, so the node never has two connected routes for the prefix. A cable plugged in after boot is picked up on the next pass. No ARP probe: the case is a laptop on a direct cable.
• netlink: SetLinkUp and AddAddress (link up plus add, no flush, no route).
• Console: new ReachableAddrs returns the routable IPv4 addresses when there are any, else the IPv4 link-local ones. ManagementAddrs is unchanged; LocalManagementAddrs (what the console reads every refresh) now uses ReachableAddrs. IPv6 link-local stays ignored, since the node configures no IPv6.
• Listener and certificate: the maintenance listener already binds 0.0.0.0:443, so it answers on the link-local address. The maintenance certificate names only localhost and is reached with --insecure on any address, and the check is the console's Mgmt SHA-256, so I left the SANs alone; that keeps the existing trust model.
• Docs: docs/management-trust.md describes the no-DHCP case and the cryptosctl --endpoint 169.254.x.x:443 --insecure call.

Closes #381

Verification

• Unit tests: address selection (routable present, only link-local, only loopback, only IPv6 link-local, none) and the maintenance Address line in each case, full and compact.
• Unit tests: the fallback leaves a routable address alone, assigns once on the first link with carrier, does nothing when one is already assigned, brings down links up, skips non-Ethernet links, and keeps checking until stopped.
• Unit tests: the netlink request sequence for SetLinkUp and AddAddress.

How this was verified

CI is the proof for this change: the Go checks run the new and existing tests. The docs command needs a booted maintenance node; the appliance end-to-end proof follows in cryptos-appliance.