Bind proxy to jail veth host IP in strong mode (fix #31)

[blink-so]

Problem

• In strong jail mode the proxy bound to 0.0.0.0, exposing ports on all interfaces.

What changed

• main: create JailConfig early and bind the proxy to the per‑jail veth host IP (10.99.X.1) on Linux
• jail/linux: expose LinuxJail::compute_host_ip_for_jail_id(jail_id)
• proxy: use IP_FREEBIND on Linux so we can bind to the veth IP before the interface exists; random-port binding uses the same path
• cargo: add socket2 (linux‑only)

Result

• Proxy listens only on the jail’s veth host IP in strong mode; no exposure on other interfaces.

Testing

• Built the binary and ran unit tests: cargo test --lib (all passed)
• Integration tests not executed here (they require root/network permissions)

Fixes #31