agent: add flock.fritzlab.net/addresses annotation (eth0 static IPs)

Like anycast, addresses IPs are advertised via BGP (/128+/32) and get
host routes via the AnycastReconciler. The sole difference: they are
assigned to pod eth0 instead of lo, so workloads that inspect their
primary interface (e.g. Plex remote-access detection) see the public IP
directly.

- annotations.go: annAddresses const, Addresses []net.IP in ParsedAnnotations
- state.go: Addresses []string persisted in allocations.json
- anycast.go: resolveAnycastTargets processes Anycast+Addresses together
- netns_linux.go: configurePodSide assigns Addresses to eth0
- netns_stub.go: mirror Addresses field for non-Linux builds
- handlers.go: thread Addresses through ADD path

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

pkg/agent/anycast.go

@@ -64,7 +64,7 @@ func resolveAnycastTargets(
 	}
 	out := map[string]anycastTarget{}
 	for _, a := range allocations {
-		if a.State != StateCommitted || len(a.Anycast) == 0 {
+		if a.State != StateCommitted || (len(a.Anycast) == 0 && len(a.Addresses) == 0) {
 			continue
 		}
 		if !isReady(a.Namespace, a.PodName) {
@@ -73,7 +73,9 @@ func resolveAnycastTargets(
 		host := HostIfaceName(a.ContainerID)
 		via6 := net.ParseIP(a.IP6)
 		via4 := net.ParseIP(a.IP4)
-		for _, ipStr := range a.Anycast {
+		// Anycast (lo-bound) and Addresses (eth0-bound) are advertised
+		// identically: /128 or /32 host route on the host, BGP via BIRD.
+		for _, ipStr := range append(a.Anycast, a.Addresses...) {
 			ip := net.ParseIP(ipStr)
 			if ip == nil {
 				continue