defaults: built-in baseline is dual-stack (IPv6 + IPv4), not IPv6-only

BuiltinFamilyDefaults() now returns {WantV6: true, WantV4: true}. Pods
that want a single family explicitly opt out via the
flock.fritzlab.net/ipv4 (or ipv6) annotation, or the operator narrows
the default at the node level via NodeConfig.Spec.Defaults.

Annotation precedence is unchanged: pod annotation > NodeConfig defaults
> built-in baseline. Tests updated to reflect the new baseline; the
"opt out of v4" path now has explicit coverage.

Docs updated:
  - NodeConfig.Spec.Defaults Go doc + CRD descriptions reflect the new
    baseline and its overrides
  - README opening framing softened from "IPv6-first" to "dual-stack,
    IPv6-friendly"; example pods + spec.defaults table flipped to
    treat dual-stack as the default and v6/v4-only as overrides
  - README NetworkPolicy line in the comparison table flipped to
    "yes (nftables)" since v1 enforcement shipped
  - Limitations note about IPv4-only destinations rewritten — every
    pod has v4 by default now, so the question is whether your IPv4
    pool is routable beyond your network

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

deploy/crds/flock.fritzlab.net_nodeconfigs.yaml

@@ -45,7 +45,7 @@ spec:
                     when its own annotations don't specify. Pod annotations
                     flock.fritzlab.net/ipv6 and flock.fritzlab.net/ipv4 always
                     override these defaults. Built-in fallback (when this block
-                    or any field is omitted) is IPv6=true, IPv4=false.
+                    or any field is omitted) is IPv6=true, IPv4=true (dual-stack).
                   properties:
                     ipv6:
                       type: boolean
@@ -56,7 +56,7 @@ spec:
                       type: boolean
                       description: |
                         Default IPv4 inclusion for pods on this node. Omit to
-                        inherit the built-in baseline (false).
+                        inherit the built-in baseline (true).
                 bgp:
                   type: object
                   required: [asn, peers]