Add the appliance web UI look, interface names, MCP and REST API, local zone

Web UI: dark/light themes (appliance layout, sidebar, switch checkboxes),
theme preference on the Advanced page, Changes page with the pending diff.

Interface names: router.interfaces.<name>.mac, lans.<l>.deviceName and
pppoe.vlanName; a rename is staged for the next reboot by router-apply.

Remote access: an MCP server (POST /mcp) and an OpenAPI REST API
(/api/v1, /api/openapi.json) with the same tokens, scopes, limits and audit
log; tools to read status, settings, leases, logs (get_logs), and to edit
and check the saved settings (never applied). Tokens on the API access page.

Firewall: a reserved `local` zone (the router itself) as the destination of
rules, so the web UI or SSH can be allowed from the WAN.

PLAN.md lists what is still left.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

pkgs/router-webui/check.go

@@ -0,0 +1,77 @@
+package main
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"time"
+)
+
+// A check evaluates the saved settings like an apply would (option types and
+// the router's assertions) without building anything: router-check.service
+// runs `nix eval` on the configuration and leaves its verdict in
+// <state>/check/result.json.
+
+type CheckResult struct {
+	OK    bool      `json:"ok"`
+	Error string    `json:"error,omitempty"`
+	Etag  string    `json:"etag"` // of the settings that were evaluated
+	Time  time.Time `json:"time"`
+}
+
+func (s System) checkResultPath() string { return filepath.Join(s.StateDir, "check", "result.json") }
+
+func (s System) readCheck() (CheckResult, bool) {
+	var r CheckResult
+	data, err := os.ReadFile(s.checkResultPath())
+	if err != nil || json.Unmarshal(data, &r) != nil {
+		return r, false
+	}
+	return r, true
+}
+
+func (s System) checkRunning() bool {
+	return unitProperty("router-check.service", "ActiveState") == "activating"
+}
+
+// checkSettings starts a check unless one runs or the last result is for the
+// current settings, and waits a while for it.
+func (a *app) checkSettings() (any, error) {
+	data, err := os.ReadFile(a.sys.settingsPath())
+	if err != nil {
+		return nil, err
+	}
+	current := etag(data)
+	if r, ok := a.sys.readCheck(); ok && r.Etag == current && !a.sys.checkRunning() {
+		return a.checkReport(r, true), nil
+	}
+	if !a.sys.checkRunning() {
+		if _, err := command("systemctl", "start", "--no-block", "router-check.service"); err != nil {
+			return nil, err
+		}
+	}
+	for range 50 {
+		time.Sleep(time.Second)
+		if a.sys.checkRunning() {
+			continue
+		}
+		if r, ok := a.sys.readCheck(); ok {
+			return a.checkReport(r, r.Etag == current), nil
+		}
+		break
+	}
+	return map[string]any{"status": "running", "next": "Still evaluating; call check_settings again in a few seconds."}, nil
+}
+
+func (a *app) checkReport(r CheckResult, current bool) map[string]any {
+	out := map[string]any{"status": "done", "ok": r.OK, "forTheSavedSettings": current, "checkedAt": r.Time}
+	if r.OK {
+		out["message"] = "The settings evaluate: the router's assertions pass."
+	} else {
+		out["error"] = r.Error
+	}
+	if !current {
+		out["note"] = "The settings changed during or after this check; call check_settings again."
+	}
+	return out
+}