Add the appliance web UI look, interface names, MCP and REST API, local zone

Web UI: dark/light themes (appliance layout, sidebar, switch checkboxes),
theme preference on the Advanced page, Changes page with the pending diff.

Interface names: router.interfaces.<name>.mac, lans.<l>.deviceName and
pppoe.vlanName; a rename is staged for the next reboot by router-apply.

Remote access: an MCP server (POST /mcp) and an OpenAPI REST API
(/api/v1, /api/openapi.json) with the same tokens, scopes, limits and audit
log; tools to read status, settings, leases, logs (get_logs), and to edit
and check the saved settings (never applied). Tokens on the API access page.

Firewall: a reserved `local` zone (the router itself) as the destination of
rules, so the web UI or SSH can be allowed from the WAN.

PLAN.md lists what is still left.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

modules/router/firewall.nix

@@ -120,8 +120,9 @@ let
       id = toString i;
       label = "${r.from}->${r.to}";
       fromDevs = if r.from == "wan" then uplinks else zoneDevices r.from;
+      toLocal = r.to == "local";
       toDevs = zoneDevices r.to;
-      base = "iifname ${set fromDevs} oifname ${set toDevs} ${daddrOf r}${l4 r.protocol r.ports r.sourcePorts}${lib.optionalString r.natOnly "ct status dnat "}";
+      base = "iifname ${set fromDevs} ${lib.optionalString (!toLocal) "oifname ${set toDevs} "}${daddrOf r}${l4 r.protocol r.ports r.sourcePorts}${lib.optionalString r.natOnly "ct status dnat "}";
       logPrefix = what: ''log prefix "router fwd#${id} ${label} ${what}: " '';
       limitLines =
         v:
@@ -148,7 +149,11 @@ let
     in
     {
       # A zone nothing is assigned to yet has no devices; the rule waits for one.
-      forward = lib.optionals (fromDevs != [ ] && toDevs != [ ]) (
+      # `local` is the router itself: those rules are on the input chain.
+      forward = lib.optionals (!toLocal && fromDevs != [ ] && toDevs != [ ]) (
+        lib.concatMap (v: limitLines v ++ acceptLines v) (variantsOf r)
+      );
+      input = lib.optionals (toLocal && fromDevs != [ ]) (
         lib.concatMap (v: limitLines v ++ acceptLines v) (variantsOf r)
       );
     };
@@ -260,6 +265,8 @@ in
           ${lib.optionalString (mgmtIfaces != [ ]) "iifname ${set mgmtIfaces} tcp dport { ${
               lib.concatMapStringsSep ", " toString ([ 22 ] ++ config.router.managementPorts)
             } } accept"}
+
+          ${lib.concatStringsSep "\n          " (lib.concatMap (p: p.input) parts)}
         }
 
         chain forward {