feat(ui): multi-line VM card + network-mode cycle restored

[DaxxSec]

Why

User feedback after the merged redesign called out two things this PR addresses together:

The VM card should be 2 lines or maybe even 3 …
one critical piece we no longer have since removing the right side panel is a way to cycle the networking type for VMs now. We used to be able to click the networking to cycle it between NAT / Router modes
lets see if we can add that capability somewhere on the larger multi-line VM card

Bundled because the cycle action needs a place to live — the new row-3 of the card.

The new card

62pt-tall row, three lines:

```
┌──────────────────────────────────────────────────────────┐
│ kali-router ● RUNNING │
│ Kali Linux 2025.1 · 4 cores · 4.0 GB · 32 GB disk │
│ [⬢ ROUTER] ↓ 12 kB/s · ↑ 0.3 kB/s 1,284 pkts ▁▄▇ │
└──────────────────────────────────────────────────────────┘
```

The row-3 chip is the network-mode target — clicking cycles:

```
NAT → Virtual (isolated) → Router → NAT
```

A guest VM (virtual-mode with a routerVMId pointing somewhere) cleanly drops to NAT in one step rather than dragging its stale guest relationship through the cycle.

Cycling a running VM is blocked — Apple's Virtualization framework attaches the network device once at VM-start and can't hot-swap it. The click still fires; the user gets an alert with that explanation.

AI Sandbox bundles use the same card with row 3 collapsed to a static badge: ◆ TEMPLATE (orange) for the base, ● SESSION (green) for children.

Implementation

• VMCardCellView (new) — NSTableCellView subclass with the three-row layout. Right-edge subviews (status pill, sparkline, packets) anchor via layout() so they track on table resize; left-edge labels reflow into available width via autoresize.
• switchTableToCardMode(_:) — drops the XIB-defined per-field columns at runtime and replaces them with a single full-width `VMCardColumn`. Idempotent.
• VMManager.cycleNetworkMode(_:) — updates the in-memory VM list and persists to metadata.json. Pure step function `nextNetworkConfig(after:)` is testable without touching the singleton.
• VMError.networkModeChangeWhileRunning — carries the user-facing alert text.

Tests

New `VMCardCellAndCycleTests` — 14 passing:

Area	Coverage
Cycle	NAT → Virtual → Router → NAT loops, guest VM short-circuits to NAT, cycle is circular
Chip rendering	NAT / ROUTER / GUEST / ISOLATED labels match config state
Status pill	RUNNING / STARTING / STOPPING / STOPPED text matches each `VMStatus`
Formatters	Packet count uses comma grouping; bps crosses B → kB → MB → GB
Cell survival	configure() doesn't crash for any status

Full suite: 264/264 green (one pre-existing flaky network test skipped as before).

Test plan

• `xcodebuild build` succeeds
• `xcodebuild test` — 264/264 passing
• Launch app — VM table shows multi-line cards; selection still works; sparkline still animates
• Click a network chip on a stopped VM — mode cycles, label updates immediately, persists across app relaunch
• Click a network chip on a running VM — alert appears explaining why; mode unchanged
• Switch to AI Sandbox tab — same card, row 3 shows ◆ BASE BUNDLE or ↳ SESSION (non-clickable)
• Cycle a VM into Router mode, start it, start a second VM with that one as its router — connection bracket overlay between the two rows still works (rows are taller but the overlay tracks rect(ofRow:) so it should follow)

Coordinating with other open PRs

#13 (detail-card layout fixes) and #14 (sidebar filter nav) both live off main. This branch is independent of both — its only mention of refreshSidebarCounts is a code comment noting that when this and #14 merge in either order, the cycle handler should also call that to refresh the Network section's count badges.

🤖 Generated with Claude Code