refactor(api): clean separation of host DPU policy from observed device mode

[chet]

Give NICo one clear vocabulary for what it should do with a host’s DPU hardware, separate from the operating mode observed on each device.

What this involves

• Replace the operator-policy DpuMode enum with HostDpuPolicy::{Manage, UseAsNic, Ignore} across per-host and site configuration, the API model, clients, and site-explorer.
• Rename the observed model state to BlueFieldOperatingMode::{Dpu, Nic} so desired policy and reported hardware state cannot be confused.
• Route DPU matching, attachment, zero-managed-DPU handling, fallback matching, and operating-mode reconciliation through the resolved host policy without changing their behavior.
• Preserve the existing inheritance rules: per-host UseAsNic and Ignore override the site; per-host Manage or an omitted policy inherits the site; an omitted site policy resolves to Manage.
• Cover the complete host/site resolution matrix and the input, wire, storage, and observed-state compatibility boundaries with tests.

Backwards compatibility

• Existing dpu_mode configuration fields, CLI flags, and values continue to deserialize.
• The protobuf DpuMode and NicMode types, field names, symbols, and numeric meanings remain unchanged for existing generated clients.
• Existing observed-state JSON continues to use DpuMode and NicMode values.
• The PostgreSQL column, enum type, and stored labels remain unchanged.

The canonical configuration and CLI vocabulary becomes dpu_policy with manage, use_as_nic, and ignore. New Rust model code uses BlueFieldOperatingMode for what hardware reports, while protobuf and Redfish retain their legacy names at compatibility boundaries.

Documentation is tracked separately in #3472.