ims-pdn-up: log mmcli errors, gate on registration, configurable ip-type

Three hardenings, each of which cost a field-debugging round-trip:

- Every mmcli failure now lands in the journal verbatim (create-bearer
  and connect stderr were swallowed, making 'connect attempt N failed'
  undecodable — no-service and interface-in-use looked identical).
- Connect attempts are gated on network registration (up to
  IMS_REG_TIMEOUT, default 300 s): the 10x10 s window is shorter than
  some carriers' post-boot attach (~2 min measured), so every attempt
  could burn out before the network was even attached. The settled
  modem/packet-service state is logged either way.
- Bearer ip-type is configurable via IMS_IP_TYPE in /etc/imsd.env
  (default ipv6); the bearer find/reuse now matches ip-type too, so a
  config change cannot silently reuse a stale bearer of the old type.

TimeoutStartSec grows 600->900 to cover the registration gate.

Tested on the FP6 dev phone (KPN): clean-state bring-up in 4 s;
gate + timeout path with modem disabled; per-attempt error lines on a
real contested-PDN failure (second ims PDN while one is connected);
idempotent reuse + REGISTERED (fresh) via systemd.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

packaging/imsd.service

@@ -9,10 +9,11 @@ Wants=ModemManager.service
 
 [Service]
 Type=simple
-# bring up the ims PDN first; waits for modem + LTE attach, idempotent.
-# worst case ~4 min (modem wait + connect retries), hence TimeoutStartSec
+# bring up the ims PDN first; waits for modem + network registration,
+# idempotent. worst case ~14 min (2 min modem wait + 5 min registration
+# gate + connect retries), hence TimeoutStartSec
 ExecStartPre=/usr/libexec/ims-pdn-up.sh
-TimeoutStartSec=600
+TimeoutStartSec=900
 # /run/imsd.env: written by ims-pdn-up.sh (DEV= the connected ims netdev).
 # /etc/imsd.env: admin configuration — PCSCF= is REQUIRED (the carrier's
 # P-CSCF address; see the README's Configuration section) and wins over the