feat: support multi-area and regional hub-spoke topologies

[lweberru]

Summary

• add stable, explicit network-area selection for connectivity consumers and complete scenario configurations
• provide regulated/shared, finance/research, and three-tenant isolation examples, with documented private shared-service constraints across SNAs
• create a dedicated firewall per network area with independent LAN/WAN settings while preserving the legacy single-firewall input
• add a single-stack eu01/eu02 regional topology with matching connectivity hubs, landing zones, Platform Kubernetes clusters, and aggregated regional outputs
• document scenarios and provider-region boundaries

Validation

• STACKIT_SERVICE_ACCOUNT_KEY_PATH="$HOME/.ssh/landingzone-sa.json" tofu test -filter=tests/multi_area.tftest.hcl
• STACKIT_SERVICE_ACCOUNT_KEY_PATH="$HOME/.ssh/landingzone-sa.json" tofu plan -refresh=false -input=false -var-file=config/hub-and-spoke-finance-research.tfvars -no-color
• STACKIT_SERVICE_ACCOUNT_KEY_PATH="$HOME/.ssh/landingzone-sa.json" tofu plan -refresh=false -input=false -var-file=config/hub-and-spoke-tenant-isolation.tfvars -no-color
• STACKIT_SERVICE_ACCOUNT_KEY_PATH="$HOME/.ssh/landingzone-sa.json" tofu plan -refresh=false -input=false -var-file=config/hub-and-spoke-multi-region.tfvars -no-color
• git diff --check

Closes #63