Guest-network creation action

• Support explicit purpose="guest" creation with a freshly verified built-in Hotspot firewall-zone ID.
• Use the controller UI payload and verify the stored guest purpose and exact zone.
• Reject missing/wrong zones, isolation, switch-routed and SD-WAN guest inputs; guest-purpose updates remain unsupported.
• Preserve create dispatch despite the new MCP preview validation; API previews show submitted arguments and confirmed calls enforce the Core guard.

Requires Core 0.4.62.

Verified against Network 10.6.106 with an approved disabled disposable network, DHCP off and no SSID or clients. Original network and zone inventories were restored. This proves configuration persistence, not traffic isolation or captive-portal behavior.

Related: #758.