Typed natmap client with honest vocabulary

[FAZuH]

Parent

#24 — Spec: One typed seam through which all NAT state flows

What to build

Auto-discover talks to the natmap daemon through a typed client module in the natmap crate, instead of building a Cli struct and round-tripping through run_cli. The client calls the existing socket protocol (request_json) directly, one typed method per operation, taking the existing typed config structs. DnatConfig.no_masquerade is renamed to preserve_src_ip so intent is visible at the call site. Errors come back as a typed enum (Conflict, ContainerNotFound, NotFound, …) mapped from the daemon's status codes; auto-discover's 409/404/"Container not found" string-matching is removed and replaced with variant matching. The CLI surface is unchanged.

Acceptance criteria

• A public client module exists in the natmap crate speaking the socket protocol directly; auto-discover uses it and no longer builds a Cli struct or calls run_cli
• Client methods take typed config structs with an explicit delete flag; DnatConfig uses preserve_src_ip (renamed from no_masquerade) across the seam
• A typed error enum maps daemon status codes to variants; auto-discover matches variants, not strings
• Every string-match on "409"/"404"/"Container not found" in auto-discover is gone
• Full workspace builds and all existing tests pass (unit suites only, no docker-tests)
• natmap and auto-discover CLI behavior is unchanged

Blocked by

None — can start immediately.