Add the home gateway config and tunnel source addresses

- wireguard.<n>.sourceAddresses: source for router-originated traffic
  into a tunnel without an address of its own (PreferredSource on the
  routes); checked at build time.
- examples/home: antigua's routing role ported to the router module
  (PPPoE with IPv6 inside the session, LAN with ULA and reservation,
  local DNS and forward zones, the freifunk/family/mobile tunnels with
  explicit zone rules, ddclient following the PPP device).
  nixosConfigurations.home, packages.installer-home and a flake check
  that builds it.
- PLAN.md: the remaining antigua gaps and the open question about
  services that stay behind the router.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

modules/router/wireguard.nix

@@ -64,7 +64,19 @@ in
           IPv6AcceptRA = false;
         };
         # Cryptokey routing: a peer's allowedIPs are the destinations sent into the tunnel.
-        routes = lib.concatMap (p: map (ip: { Destination = ip; }) p.allowedIPs) (lib.attrValues wg.peers);
+        routes = lib.concatMap (
+          p:
+          map (
+            ip:
+            let
+              sameFamily = lib.filter (s: lib.hasInfix ":" s == lib.hasInfix ":" ip) wg.sourceAddresses;
+            in
+            {
+              Destination = ip;
+            }
+            // lib.optionalAttrs (sameFamily != [ ]) { PreferredSource = builtins.head sameFamily; }
+          ) p.allowedIPs
+        ) (lib.attrValues wg.peers);
       }
     ) cfg.wireguard;
   };