policy/v2: refactor alias resolution to use ResolvedAddresses

Introduce ResolvedAddresses type for structured IP set results. Refactor all Alias.Resolve() methods to return ResolvedAddresses instead of raw IPSets. Restrict identity-based aliases to matching address families, fix nil dereferences in partial resolution paths, and update test expectations for the new IP format (bare IPs, IP ranges instead of CIDR prefixes).

Updates #2180

hscontrol/policy/policy_autoapprove_test.go

@@ -19,11 +19,11 @@ import (
 func TestApproveRoutesWithPolicy_NeverRemovesApprovedRoutes(t *testing.T) {
 	user1 := types.User{
 		Model: gorm.Model{ID: 1},
-		Name:  "testuser@",
+		Name:  "testuser",
 	}
 	user2 := types.User{
 		Model: gorm.Model{ID: 2},
-		Name:  "otheruser@",
+		Name:  "otheruser",
 	}
 	users := []types.User{user1, user2}