Add tenant SitePrefix and exact VpcPrefix workflows to nicocli

[chet]

The REST CLI already has IPBlock and VpcPrefix commands and picker/cache patterns. Tenants need the corresponding SitePrefix lifecycle and an exact-carving choice in VpcPrefix create without seeing provider-only IPBlocks or fields they are not allowed to set.

Current state

• rest-api/cli/tui/commands.go has IPBlock and VpcPrefix command handlers.
• rest-api/cli/tui/session.go registers resource fetchers and resolver caches.
• VpcPrefix create currently selects an IPBlock and prefix length.

General idea

• Add tenant SitePrefix list/get/create/update/retire commands using existing nicocli Client.Do/request conventions and generated types where the CLI already uses them.
• Add SitePrefix resolver/cache entries and reuse existing Site, IPBlock, and VpcPrefix picker conventions.
• Extend VpcPrefix create with a clear automatic-provider versus exact-tenant mode. In exact mode, show only Ready SitePrefixes visible to the current tenant/site and prompt for a canonical child CIDR.
• Keep IPv4 and DatacenterOnly fixed in the tenant flow rather than exposing unsupported controls.
• Render lifecycle status, reason, child/DPU blockers, and tenant quota used/limit; invalidate/update caches after a mutation.
• Label exact mode as a private DatacenterOnly CIDR allocation and do not imply public/BYOIP announcement or root-global availability.
• Preserve direct/non-interactive command behavior where the current CLI supports it; do not make the TUI picker the only path.

Acceptance criteria

• A tenant can list/get/create/update/retire its SitePrefixes from nicocli.
• VpcPrefix create supports the existing automatic path and the new exact tenant path with unambiguous request bodies.
• Pickers filter by tenant, site, Ready state, and origin.
• Status and Core/REST validation errors remain readable without leaking another tenant's resources.
• Navigation, argument parsing, request bodies, empty lists, stale-cache invalidation, and cross-tenant filtering are tested.
• Existing IPBlock and VpcPrefix commands remain compatible.

Not in this issue

• Core admin CLI.
• Provider site-bootstrap changes.
• A new web UI.
• Server-side authorization or CIDR validation.

Likely areas

• rest-api/cli/tui/commands.go and commands_test.go
• rest-api/cli/tui/session.go and resolver/cache code
• existing nicocli client/request code and generated REST types where used
• CLI examples/help where applicable

Planning

• Size: M
• Risk: Medium
• Best fit: Guided junior/mid-level Go engineer with REST review

Dependencies

• Native blocked by: Expose tenant-managed SitePrefix lifecycle through REST #3899 — Expose tenant-managed SitePrefix lifecycle through REST, Support exact VpcPrefix leases from tenant SitePrefixes #3900 — Support exact VpcPrefix leases from tenant SitePrefixes
• Coding can start: Expose tenant-managed SitePrefix lifecycle through REST #3899 and Support exact VpcPrefix leases from tenant SitePrefixes #3900 public contracts
• Enablement: Qualify and gate tenant-managed SitePrefixes across Core, DPU, and REST #3902 and the REST site capability
• Parallel work: Final qualification and documentation once public types settle

Part of #3883.