feat: implement stateful NAT64/NAT46 translation (#531)

[thedancingdeveloper]

Summary

• route NAT64 and NAT46 through a stateful cross-family translator instead of false same-family PF NAT rules
• validate family-specific prefixes and reject unsupported combinations before persistence
• add a narrow privileged translator helper and package it into the appliance
• add regression coverage for validation and translator rule generation

Closes ZerosAndOnesLLC#531

Validation

• cargo fmt --all -- --check
• cargo clippy -p aifw-common -p aifw-core -p aifw-setup --all-targets -- -D warnings
• cargo test -p aifw-common -p aifw-core -p aifw-setup