feat(prompt): show profile network rules in first-run prompt

[tito]

Summary

• The first-run profile prompt showed filesystem allow/deny lines but silently omitted the profile's network rules, so users approving `greywall -- claude` could not see which hosts were about to be pushed to greyproxy as session-scoped rules.
• Render `Allow net:` / `Deny net:` lines alongside the filesystem ones, reusing the same green/red coloring. Port is shown only when non-wildcard so the common `host:443` case stays compact.

Before

```
Allow read: ~/CLAUDE.md ...
Allow write: ~/.skills ...
Deny read: ~/.ssh/id_* ...
Deny write: ~/.bashrc ...

[Y] Use profile (recommended) ...
```

After

```
Allow read: ~/CLAUDE.md ...
Allow write: ~/.skills ...
Deny read: ~/.ssh/id_* ...
Deny write: ~/.bashrc ...
Allow net: api.anthropic.com:443 mcp-proxy.anthropic.com:443 downloads.claude.ai:443 platform.claude.com:443 github.com:443 api.github.com:443 *.githubusercontent.com:443 registry.npmjs.org:443 storage.googleapis.com:443

[Y] Use profile (recommended) ...
```

Test plan

• `go test ./internal/profiles/...` passes with the extended assertions
• Manual render of the claude profile prompt via a throwaway demo binary
• Manual: run `greywall -- claude` interactively and verify the Allow net line appears