Allow explicit per-SNA VPN gateway and connection configuration #85

Problem

On main at 2bb7c75, enabling VPN selects every network area and creates every declared connection on every gateway:

• VPN gateway and connection expansion
• Root VPN configuration

A deployment with SNAs production and sandbox cannot enable VPN only for production, or use different connections per SNA. Regional entry points separate regions, but not SNAs within a region. This is separate from #64 (automated inter-region connectivity).

The Configurator currently exposes the existing behavior and explicitly explains that VPN configuration is replicated to all SNAs; it must not present an unsupported per-SNA selector.

Proposed scope

• Explicit SNA selection and per-SNA gateway/connection settings.
• Validate all referenced network-area keys.
• Unambiguous SNA/connection identity for secret references.
• Document compatibility and migration; no silent address changes or resource destruction.

Acceptance criteria

• A two-SNA plan can create VPN only for one selected SNA.
• Distinct peers/settings can be configured for different SNAs.
• Unknown SNA references fail validation.
• Existing single-area configurations retain their behavior.
• Tests cover selective, per-SNA and legacy configurations.
• Migration of existing multi-SNA VPN resources is documented.