Add the home gateway config and tunnel source addresses

- wireguard.<n>.sourceAddresses: source for router-originated traffic
  into a tunnel without an address of its own (PreferredSource on the
  routes); checked at build time.
- examples/home: antigua's routing role ported to the router module
  (PPPoE with IPv6 inside the session, LAN with ULA and reservation,
  local DNS and forward zones, the freifunk/family/mobile tunnels with
  explicit zone rules, ddclient following the PPP device).
  nixosConfigurations.home, packages.installer-home and a flake check
  that builds it.
- PLAN.md: the remaining antigua gaps and the open question about
  services that stay behind the router.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

flake.nix

@@ -40,6 +40,10 @@
           ];
         };
 
+      packages.x86_64-linux.installer-home =
+        (self.lib.mkInstaller { configuration = self.nixosConfigurations.home; })
+        .config.system.build.isoImage;
+
       packages.x86_64-linux.installer-example =
         (self.lib.mkInstaller { configuration = self.nixosConfigurations.example; })
         .config.system.build.isoImage;
@@ -53,6 +57,15 @@
         ];
       };
 
+      # The home gateway replacing antigua's router role (see examples/home).
+      nixosConfigurations.home = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+        modules = [
+          self.nixosModules.router
+          ./examples/home
+        ];
+      };
+
       # `nix run .#deploy -- <flake-attr> <user@host>`: activate a new
       # configuration with commit-confirm; see scripts/deploy.sh.
       apps.x86_64-linux.deploy =
@@ -82,6 +95,7 @@
         // {
           # The example must keep building as a complete system.
           example = self.nixosConfigurations.example.config.system.build.toplevel;
+          home = self.nixosConfigurations.home.config.system.build.toplevel;
         };
 
       # `nix run .#lab`: boot the basic test topology in tmux, one console pane