fix(project-cleanup): robust router + network teardown

[kallioli]

Context

A real run of orca project cleanup on a project holding 30 servers, 1 router and 1 network left the router and its network undeletable with two 409 Conflict errors:

✗ router router-interconnect: Router ... has ports still attached: 0d57177b-...
✗ network net-interconnect: ... There are one or more ports still in use on the network, id for these ports is: 0d57177b-...

Both errors trace to the same port — the router's interface — which was never detached.

Root cause in orca_cli/commands/project.py (old _delete_one router branch):

ports = net_svc.find_ports(params={
    "device_id": rid,
    "device_owner": "network:router_interface",
})

This filter only matches legacy L3 routers. It misses:

• network:router_interface_distributed (DVR),
• network:ha_router_replicated_interface (HA routers),
• network:router_gateway + network:router_centralized_snat (external gateway).

The untouched port then transitively blocked the network delete.

Changes

• New helper _delete_router:
  • Clears external_gateway_info via update_router before anything else (releases gateway + centralized-SNAT ports that can't be removed via remove_router_interface).
  • Lists ports by device_id only and filters Python-side, so DVR / HA / legacy interfaces are all detached in the same pass.
  • Tolerant of Neutron errors on gateway-clear and interface-remove — never aborts before the final delete_router.
• New helper _delete_network:
  • Before deleting the network, purges orphan ports (empty device_owner) and stale compute VIFs (compute:*) whose server is already gone.
  • Neutron-owned ports (dhcp, router, floatingip) are intentionally left alone — they are released by their respective delete paths.
• _delete_one now delegates the router / network branches to these helpers.
• New tests/test_project_cleanup.py with 11 unit tests covering: gateway clearing, all three interface flavors, non-interface ports being ignored, orphan + compute-VIF purge, and full tolerance to Neutron failures at every step.

Tests

• ruff check .
• mypy
• pytest — 2288 passed
• pytest --cov=orca_cli --cov-fail-under=85 — 87.56% total

Risks

• The gateway-clear PUT hits every router to be deleted, including those without a gateway; Neutron silently accepts external_gateway_info: null as a no-op in that case, and failures are swallowed by design.
• Compute VIF cleanup runs after the server-delete phase in the global order, so deleting a VIF whose server is still alive cannot happen in normal flow.
• Does not fix the volume 404 / 400 classes of errors observed in the same run — those are addressed by the follow-up PR on output categorization (404 as idempotent success) and a subsequent change on pre-phase rescanning + polling.