Add router-on-a-stick, commit-confirm rollback and an example config

- Allow the WAN link to also carry LANs when the uplink is PPPoE on a
  VLAN with IPv6 off; only the PPP device counts as an uplink then, so
  LAN traffic can never match WAN rules.
- Add router.rollback: router-arm / router-confirm / router-rollback
  plus `nix run .#deploy`, a commit-confirm deployment flow.
- Wait for the LAN devices instead of the uplink in networkd
  wait-online, so an unplugged uplink cannot block boot or activation.
- Add examples/desktop (single NIC, PPPoE on VLAN 1001) as
  nixosConfigurations.example, built as a flake check.

Covered by the onestick and rollback VM tests and new assertion cases.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

modules/router/rollback.nix

@@ -0,0 +1,82 @@
+# Commit-confirm for deployments. `router-arm` starts a timer; unless
+# `router-confirm` stops it in time, `router-rollback` re-activates the last
+# confirmed generation. Pair it with `nixos-rebuild test` (activate without
+# changing the boot default): a reboot also comes back to the confirmed system.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.router.rollback;
+  profile = "/nix/var/nix/profiles/system";
+
+  tools = [
+    pkgs.coreutils
+    config.systemd.package
+  ];
+
+  # The confirmed system: the profile, or what booted if there is none.
+  confirmed = ''
+    target=${profile}
+    [ -e "$target/bin/switch-to-configuration" ] || target=/run/booted-system
+  '';
+
+  rollback = pkgs.writeShellApplication {
+    name = "router-rollback";
+    runtimeInputs = tools;
+    text = ''
+      ${confirmed}
+      echo "router: rolling back to $(readlink -f "$target")"
+      exec "$target/bin/switch-to-configuration" test
+    '';
+  };
+
+  arm = pkgs.writeShellApplication {
+    name = "router-arm";
+    runtimeInputs = tools;
+    text = ''
+      timeout=''${1:-${cfg.timeout}}
+      systemctl stop router-rollback.timer router-rollback.service 2>/dev/null || true
+      systemd-run --quiet --unit=router-rollback --on-active="$timeout" \
+        --timer-property=AccuracySec=1s ${rollback}/bin/router-rollback
+      echo "router: rollback in $timeout unless confirmed (router-confirm)"
+    '';
+  };
+
+  confirm = pkgs.writeShellApplication {
+    name = "router-confirm";
+    runtimeInputs = tools;
+    text = ''
+      systemctl stop router-rollback.timer
+      current=$(readlink -f /run/current-system)
+      ${config.nix.package}/bin/nix-env -p ${profile} --set "$current"
+      "$current/bin/switch-to-configuration" boot
+      echo "router: confirmed $current"
+    '';
+  };
+in
+{
+  options.router.rollback = {
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "Install the commit-confirm helpers `router-arm`, `router-confirm` and `router-rollback`.";
+    };
+    timeout = lib.mkOption {
+      type = lib.types.str;
+      default = "5min";
+      example = "90s";
+      description = "How long a deployment may stay unconfirmed before it is rolled back (systemd time span).";
+    };
+  };
+
+  config = lib.mkIf (config.router.enable && cfg.enable) {
+    environment.systemPackages = [
+      arm
+      confirm
+      rollback
+    ];
+  };
+}