fix(tee)!: restrict the operator-only node ports to the operator's IP

[samlaf]

Only :22 was source-restricted; every other rule in the node NSG got source *, tdx-init's :8080 config listener included. That listener is unauthenticated and first-POST-wins, so whoever reached it ahead of the operator enrolled the box into their network — their manifest, their measurement policy, their bootnode list, so their root_key. Its "close after first deploy" comment was never achievable either: the conf dir is tmpfs, so the listener comes back for a fresh POST on every boot.

OPEN_PORTS now carries a per-port source column instead of special-casing the ssh rule by name. :22 and :8080 are operator-only; the peer-facing ports (:80/:443, the enclave's :7878 root_key fetch, summit consensus, reth devp2p) keep source * deliberately — admission there is app-layer pubkey authentication, and an IP allowlist would break nodes that join later.

:7879 is reserved and restricted ahead of the service that will use it: a summit key holder serving the node's summit pubkeys plus a TDX quote over them to whoever is assembling a founding validator set. Its restriction is permanent rather than founding-window-only, since the holder mints fresh RAM keys and reopens the quote window on every boot until the keystore exists.

source_ip_cidr becomes operator_ip_cidr: the old name described the Azure field the value lands in, while the reader choosing it needs to know whose address it is — and it now gates three ports, not just ssh. The playground project keeps source_ip_cidr, where it means SSH access to a dev box and feeds ssh_source_cidrs directly.

tee/README.md's footgun entry claimed the :8080 restriction already existed; it now points at where the restriction lives and says plainly that the stack setting is the whole guard. The dev stack still ships 0.0.0.0/0, which opts out of it — both comments now say so.

BREAKING: the source_ip_cidr stack config key is now operator_ip_cidr. Existing seismic_node stacks fail on the next pulumi up with a missing-required-variable error until pulumi config set operator_ip_cidr <cidr> is run.