New gatewayInternalNetworks managed setting restricts Cloud gateway sign-in to declared network ranges

What

A new admin-only managed-settings key, gatewayInternalNetworks, lets an organization declare the CIDR (network address range) blocks its Cloud gateway login host must resolve within.

• Up to 4 non-overlapping blocks can be listed; Claude Code validates them and rejects public/documentation/reserved or overlapping ranges, and caps how many can be listed.
• On /login, Claude Code checks that both DNS resolution and the actual TLS connection to the gateway land inside a declared network, and refuses sign-in with a specific error if the machine's address or the gateway's answer falls outside it.
• If the resolved gateway host falls inside a declared network but the connection would route through an HTTP proxy, login now refuses to proceed and tells the user to add the host to NO_PROXY instead.
• The setting is merged using "highest source wins" rules, the same treatment given to forceLoginOrgUUID, forceLoginMethod, and forceLoginGatewayUrl, and it's threaded into the OAuth/gateway login screen.

Why

This lets an organization pin employee sign-in to a gateway that only exists on its own private or approved network, closing off sign-in attempts (or man-in-the-middle style redirects) that resolve or connect outside that network.