LIR: registry/RPKI provider config layer (RIPE IRR + Krill) per company/IP block

[v0l]

Part of the LIR sponsoring epic (see #39).

The registry clients exist (lnvps_api_common/src/registry/: RegistryProvider/RpkiProvider traits, RipeDb whois client, Krill delegated-RPKI client) and IP-range fulfilment already calls them behind optional providers. Today the provisioner is constructed with None providers because there is no config/lookup layer yet.

Scope

• DB-backed provider config (like dns_server): a registry_provider config (kind = RIPE, source, maintainer/API key/password) and an rpki_provider config (Krill base URL, token, CA handle). Migration + model + admin CRUD.
• get_registry_provider(...) / get_rpki_provider(...) constructors that build RipeDb / Krill from config (mirror get_dns_server).
• Associate providers per company and/or per available_ip_space block (route-object maintainer + three-tier auth differs per block).
• Wire IpRangeProvisioner (and the ASN provisioner, LIR: ASN sponsoring provisioner, aut-num object & admin assignment flow #190) to build real providers from config instead of None.
• RPKI stays independently optional (ROV is not universal; a missing ROA is NotFound, not Invalid) — route object only, ROA only, both, or neither must all work.

Notes

• RIPE hosted RPKI is LIR-only and cannot sign sponsored space, hence Krill (delegated RPKI). See registry module docs.
• Handle RIPE route-object three-tier authorisation (object mnt-by + address-space mnt + origin aut-num mnt) via per-block maintainer config.

Depends on: registry clients (done). Unblocks real fulfilment for IP ranges (#39) and ASNs (#190).