Add the home gateway config and tunnel source addresses

- wireguard.<n>.sourceAddresses: source for router-originated traffic
  into a tunnel without an address of its own (PreferredSource on the
  routes); checked at build time.
- examples/home: antigua's routing role ported to the router module
  (PPPoE with IPv6 inside the session, LAN with ULA and reservation,
  local DNS and forward zones, the freifunk/family/mobile tunnels with
  explicit zone rules, ddclient following the PPP device).
  nixosConfigurations.home, packages.installer-home and a flake check
  that builds it.
- PLAN.md: the remaining antigua gaps and the open question about
  services that stay behind the router.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

modules/router/options.nix

@@ -296,6 +296,19 @@ in
                   empty means no transfer network (fine for site-to-site).
                 '';
               };
+              sourceAddresses = mkOption {
+                type = types.listOf types.str;
+                default = [ ];
+                example = [ "192.168.10.1" ];
+                description = ''
+                  Source address (at most one per family) for traffic the router
+                  itself sends into this tunnel, e.g. DNS queries to the other
+                  site. Needed when the tunnel has no address of its own, so the
+                  other side sees a source it routes back instead of whatever the
+                  kernel picks. IPv4 ones must be an address the router holds on
+                  a LAN or a tunnel.
+                '';
+              };
               zone = mkOption {
                 type = types.str;
                 default = name;