Add router-upgrade for nixpkgs upgrades on the router

router.update.channel names the nixpkgs branch to follow (unstable or a
release like 26.05). router-upgrade check compares its newest tested
revision with the running one; preview locks a copy of the configuration
flake to it and lists the packages that change version and the size of the
download without fetching anything; download fetches it; apply takes the
lock and activates with commit-confirm, the lock going back on a rollback
or a failed build. router-update keeps an upgraded nixpkgs pinned.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

modules/settings/default.nix

@@ -124,7 +124,10 @@ let
   webui = pkgs.callPackage ../../pkgs/router-webui/package.nix { };
 in
 {
-  imports = [ ./update.nix ];
+  imports = [
+    ./update.nix
+    ./upgrade.nix
+  ];
 
   # Outside `router`: the settings file defines that whole tree.
   options.routerSettings = {