Bridge VLAN table and port PVID tools for MikroTik MCP

Before this pull request, an assistant using the MikroTik server could create VLAN sub-interfaces, but it couldn't touch the bridge VLAN table at all. That table says which ports carry each VLAN, tagged or untagged. Each bridge port also has a PVID for untagged traffic. Without both, you can't build a VLAN-filtering switch through the server. This closes issue 105.

The new bridge module adds six tools. Four manage the bridge VLAN table: list, add, update and remove. Two cover ports: one lists them with their PVIDs, and one updates the PVID, the accepted frame types and ingress filtering. Reads are marked read only, so read-only mode exposes just the two list tools. VLAN ids can be a single id, a comma list, or a range like 100 to 199.

Two follow-up commits matter most. First, RouterOS prints nothing on success and stays silent when a set matches nothing, so the early code reported success for changes that never happened. Updates now count first and say not found, and any output from a write is treated as a refusal. Second, filter and name values were put into commands unescaped, so a crafted value could run a second command, even through a read-only tool. Everything now goes through the shared quoting helper, with fifteen tests that failed before. Dynamic entries created from PVIDs are never touched.

A reviewer tested this on real hardware with a read-only account, and the refusals came back as failures with the device untouched. The unit suite has fifty bridge tests and about 750 overall. Two non-blocking gaps remain. VLAN ids aren't range checked, though RouterOS refuses bad ones. And removing an entry doesn't mention a dynamic entry with the same id that survives. If the API coverage manifest merges first, the six tools need to be declared there.