Extract network resources into reusable modules/network module

Moves the three incus_network resources into a dedicated module called
once per entry in var.incus_networks. State was migrated imperatively
via `terraform state mv` because lxc/incus v1.0.2 does not implement
ResourceWithMoveState, making declarative moved blocks unsupported.
Plan confirms zero creates/destroys after migration.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

incus/modules/network/main.tf

@@ -0,0 +1,36 @@
+terraform {
+  required_providers {
+    incus = {
+      source = "lxc/incus"
+    }
+  }
+}
+
+resource "incus_network" "hypervisor" {
+  for_each = var.hypervisors
+  name     = var.name
+  target   = each.key
+  type     = var.type
+  config = {
+    "parent" = var.hypervisor_parent
+  }
+}
+
+resource "incus_network" "witness" {
+  for_each = var.witnesses
+  name     = var.name
+  target   = each.key
+  type     = var.type
+  config = {
+    "parent" = var.witness_parent
+  }
+}
+
+resource "incus_network" "this" {
+  depends_on = [
+    incus_network.hypervisor,
+    incus_network.witness,
+  ]
+  name = var.name
+  type = var.type
+}

incus/modules/network/outputs.tf

@@ -0,0 +1,7 @@
+output "name" {
+  value = incus_network.this.name
+}
+
+output "type" {
+  value = incus_network.this.type
+}

incus/modules/network/variables.tf

@@ -0,0 +1,26 @@
+variable "name" {
+  type = string
+}
+
+variable "type" {
+  type    = string
+  default = "physical"
+}
+
+variable "hypervisors" {
+  type = set(string)
+}
+
+variable "witnesses" {
+  type = set(string)
+}
+
+variable "hypervisor_parent" {
+  type    = string
+  default = "br0"
+}
+
+variable "witness_parent" {
+  type    = string
+  default = "dummy0"
+}