Add the appliance web UI look, interface names, MCP and REST API, local zone

Web UI: dark/light themes (appliance layout, sidebar, switch checkboxes),
theme preference on the Advanced page, Changes page with the pending diff.

Interface names: router.interfaces.<name>.mac, lans.<l>.deviceName and
pppoe.vlanName; a rename is staged for the next reboot by router-apply.

Remote access: an MCP server (POST /mcp) and an OpenAPI REST API
(/api/v1, /api/openapi.json) with the same tokens, scopes, limits and audit
log; tools to read status, settings, leases, logs (get_logs), and to edit
and check the saved settings (never applied). Tokens on the API access page.

Firewall: a reserved `local` zone (the router itself) as the destination of
rules, so the web UI or SSH can be allowed from the WAN.

PLAN.md lists what is still left.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

modules/router/networking.nix

@@ -9,7 +9,11 @@ let
   v6dev = if v6ppp then cfg.wan.ipv4.interface else cfg.wan.interface;
   pppoe = cfg.wan.ipv4.type == "pppoe";
   vlan = cfg.wan.ipv4.pppoe.vlan;
-  vlanDevice = "${cfg.wan.interface}.${toString vlan}";
+  vlanDevice =
+    if cfg.wan.ipv4.pppoe.vlanName != null then
+      cfg.wan.ipv4.pppoe.vlanName
+    else
+      "${cfg.wan.interface}.${toString vlan}";
   wanVlanOn = parent: lib.optional (pppoe && vlan != null && parent == cfg.wan.interface) vlanDevice;
 
   lans = lib.attrValues cfg.lans;
@@ -38,6 +42,32 @@ in
       lib.attrValues cfg.lans
     );
 
+    # Rename network cards by MAC address. Only at boot: the interface that is
+    # up cannot be renamed, and router-apply stages such a change for the
+    # next boot instead of activating it (see the names file below).
+    systemd.network.links = lib.mapAttrs' (
+      name: i:
+      lib.nameValuePair "05-${name}" {
+        matchConfig = {
+          PermanentMACAddress = i.mac;
+          Type = "ether";
+        };
+        linkConfig.Name = name;
+      }
+    ) cfg.interfaces;
+
+    # The names this system gives to devices; router-apply compares the file
+    # between the running and the new system and stages a change of a name for
+    # the next boot (a device that is up cannot be renamed).
+    environment.etc."router/interface-names".text =
+      lib.concatMapStrings (l: l + "\n") (
+        lib.sort lib.lessThan (
+          lib.mapAttrsToList (name: i: "nic ${i.mac} ${name}") cfg.interfaces
+          ++ map (l: "vlan ${l.interface} ${toString l.vlan} ${l.device}") vlanLans
+          ++ lib.optional (pppoe && vlan != null) "vlan ${cfg.wan.interface} ${toString vlan} ${vlanDevice}"
+        )
+      );
+
     boot.kernel.sysctl = {
       "net.ipv4.conf.all.forwarding" = 1;
       "net.ipv6.conf.all.forwarding" = 1;