tunnel route ip show: --filter-network-is-subset-of sends the superset filter #1750

cloudflared tunnel route ip show --filter-network-is-subset-of <cidr> (alias --nsub) queries the API with network_superset=<cidr> instead of network_subset=<cidr>, so it behaves identically to --filter-network-is-superset-of.

Cause: in cfapi/ip_route_filter.go, NewIpRouteFilterFromCLI calls f.NetworkIsSupersetOf(*subset). NetworkIsSubsetOf exists but is never called.

Reproduced on master (059f86a) with a test that encodes the filter. Fix is a one-line change plus a regression test. Happy to send a PR if that works for you.

AI disclosure: I used AI tools to find and reproduce this; I reviewed it myself.