Initial commit: BF Core-Switch-Prep + VLAN-Architektur + Delegations-Übergabe

- ALL-SG8316M auf FW 2.2.1.2956 geflasht; VLAN-DB 10/20/30/40/100 via Telnet-CLI (non-disruptiv)
- CLI-Tooling: run-cli.exp + .cli-Files + CLI-REFERENCE (FW 2.2.1, IOS-artig)
- Kanonisches Inventar: bf.csv/md + build.py (Doku-Motor), Core-Port-Map
- Finaler VLAN-/Adressplan (10.40.<vlanid>.0/24), Firmware-Runbooks, Recovery-Assets
- Secrets/Firmware/State/DS_Store via .gitignore ausgeschlossen

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

switch/cli/run-cli.exp

@@ -0,0 +1,33 @@
+#!/usr/bin/expect -f
+# Generischer Telnet-CLI-Runner für sw1 (ALL-SG8316M, FW 2.2.1, IOS-artige CLI).
+# Nutzung:  . switch/.secrets && expect switch/cli/run-cli.exp switch/cli/<datei>.cli
+# Liest die .cli-Datei zeilenweise, loggt ein, sendet jeden Befehl, flaggt Fehler.
+# Zeilen mit führendem '#' = Kommentar (übersprungen). Am Ende: show vlan zur Kontrolle.
+set timeout 20
+set user $env(SW_USER)
+set pass $env(SW_PASS)
+set host $env(SW_HOST)
+if {[llength $argv] < 1} { puts "usage: run-cli.exp <file.cli>"; exit 1 }
+set fh [open [lindex $argv 0] r]
+log_user 1
+spawn telnet $host
+expect "Username:"; send "$user\r"
+expect "Password:"; send "$pass\r"
+expect -re {sw1[#>]}
+while {[gets $fh line] >= 0} {
+    set line [string trim $line]
+    if {$line eq "" || [string match "#*" $line]} { continue }
+    send "$line\r"
+    expect {
+        "Incomplete command" { puts "\n>>> FEHLER (incomplete): $line" }
+        "Unknown command"    { puts "\n>>> FEHLER (unknown): $line" }
+        -re {sw1\([^)]*\)[#>] ?$} {}
+        -re {sw1[#>] ?$} {}
+        timeout { puts "\n>>> TIMEOUT bei: $line" }
+    }
+}
+close $fh
+send "show vlan\r"
+expect -re {sw1[#>]}
+send "exit\r"
+expect eof