Reserve first 10 IPs (.0-.9) per subnet for system use

IPAM tunnel cursor starts at offset 10. Addresses .0-.9 are reserved:
.0 = network, .1 = server gateway, .2-.9 = future system services
(DNS, relay, monitoring, etc). First client gets .10.

Author: Geramy

projects/LemonadeNexus/include/LemonadeNexus/IPAM/IPAMService.hpp

@@ -75,8 +75,8 @@ class IPAMService : public core::IService<IPAMService>,
     std::unordered_map<std::string, AllocationSet> allocations_;
 
     /// Cursor trackers for sequential allocation within each block.
-    /// Tunnel starts at offset 2: .0 = network, .1 = server gateway.
-    uint32_t next_tunnel_ip_{2};   // next offset within 10.64.0.0/10
+    /// First 10 IPs (.0-.9) reserved for system: .0=network, .1=gateway, .2-.9=future.
+    uint32_t next_tunnel_ip_{10};  // next offset within 10.64.0.0/10
     uint32_t next_private_ip_{0};  // next offset within 10.128.0.0/9
     uint32_t next_shared_ip_{0};   // next offset within 172.20.0.0/14
 };

projects/LemonadeNexus/src/IPAM/IPAMService.cpp

@@ -337,8 +337,8 @@ void IPAMService::load_allocations() {
         if (aset.tunnel) {
             auto [ip, prefix] = parse_cidr(aset.tunnel->base_network);
             uint32_t offset = ip - kTunnelBase + 1;
-            // Never go below 2 — .0 is network, .1 is server gateway
-            if (offset > next_tunnel_ip_) next_tunnel_ip_ = std::max(offset, uint32_t{2});
+            // Never go below 10 — .0-.9 reserved for system use
+            if (offset > next_tunnel_ip_) next_tunnel_ip_ = std::max(offset, uint32_t{10});
         }
         if (aset.private_subnet) {
             auto [ip, prefix] = parse_cidr(aset.private_subnet->base_network);