Create a region

Adds a geographic region to the network directory. This is a back-office MAINTENANCE operation: the created region immediately becomes a selectable grouping stores can be assigned to. The id is caller-supplied — pick a stable, URL-safe slug (e.g. reg-bre), because it is the handle every other maintenance verb addresses it by; 409s when a region already carries it (a create never overwrites — use the update operation instead). active is optional and defaults to true; storeCount is optional and defaults to 0 (a fresh region holds no stores until one is assigned to it — it is a stored counter, not a live join). PERMISSION TRAP (see solya-pos#950): the route guard accepts pos.settings.manage, but the use-case additionally asserts the kernel config:manage permission and NO pos.settings.* scope maps to it, so a principal authenticated by scopes alone clears the guard and then 403s inside the use-case — only a session whose role carries config:manage can actually create.