Add router-on-a-stick, commit-confirm rollback and an example config

- Allow the WAN link to also carry LANs when the uplink is PPPoE on a
  VLAN with IPv6 off; only the PPP device counts as an uplink then, so
  LAN traffic can never match WAN rules.
- Add router.rollback: router-arm / router-confirm / router-rollback
  plus `nix run .#deploy`, a commit-confirm deployment flow.
- Wait for the LAN devices instead of the uplink in networkd
  wait-online, so an unplugged uplink cannot block boot or activation.
- Add examples/desktop (single NIC, PPPoE on VLAN 1001) as
  nixosConfigurations.example, built as a flake check.

Covered by the onestick and rollback VM tests and new assertion cases.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

modules/router/firewall.nix

@@ -179,10 +179,9 @@ let
   uplink4 = cfg.wan.ipv4.interface;
   pppoe = cfg.wan.ipv4.type == "pppoe";
   # IPv4 leaves via the PPP device, IPv6 via the physical uplink.
-  uplinks = lib.unique [
-    cfg.wan.interface
-    uplink4
-  ];
+  # When the physical link also carries LANs, only the PPP device is an uplink.
+  sharedLink = lib.elem cfg.wan.interface (map (l: l.interface) lans);
+  uplinks = lib.unique ([ uplink4 ] ++ lib.optional (!sharedLink) cfg.wan.interface);
   mss = cfg.wan.ipv4.pppoe.mtu - 40;
   dhcpIfaces = map (l: l.device) (lib.filter (l: l.dhcp.enable) lans);
 in