Create a Hetzner Cloud private network, attach servers to it, and configure the guest OS

Documented steps

1. POST /v1/networks with name and ip_range (a CIDR, e.g. 10.0.0.0/16). Optionally pass subnets, routes, labels and expose_routes_to_vswitch.
2. Each subnet in the create request takes type, ip_range and network_zone. Use type 'cloud'. The other enum values are 'vswitch' (which also needs vswitch_id, for connecting a Hetzner Robot dedicated-server vSwitch) and 'server', which the spec describes as deprecated in favour of 'cloud'.
3. network_zone must match the zone of the servers you intend to attach. The four zones are eu-central (fsn1, nbg1, hel1), us-east (ash), us-west (hil) and ap-southeast (sin). See https://docs.hetzner.com/cloud/general/locations/
4. Add custom routes as {"destination": "<CIDR>", "gateway": "<ip>"} to send traffic for a prefix through a NAT or gateway instance.
5. Attach a server with POST /v1/servers/{id}/actions/attach_to_network with body {"network": <id>} plus optional ip (a specific private address), alias_ips and ip_range (to select a subnet).
6. You can also attach at creation time by passing networks: [<id>] to POST /v1/servers.
7. Poll the returned action, then verify the private address appears under server.private_net.
8. Inside the guest, current Hetzner cloud images configure the private interface automatically via cloud-init 25.3+ or the hc-utils package, which runs a DHCP client when a new private interface appears. Usually no manual step is needed. See https://docs.hetzner.com/networking/networks/server-configuration/
9. If you must configure statically, first disable or remove hc-utils, then set the address with a /32 mask, set MTU 1450, and add an explicit route to the subnet range via the gateway.