Add the appliance web UI look, interface names, MCP and REST API, local zone

Web UI: dark/light themes (appliance layout, sidebar, switch checkboxes),
theme preference on the Advanced page, Changes page with the pending diff.

Interface names: router.interfaces.<name>.mac, lans.<l>.deviceName and
pppoe.vlanName; a rename is staged for the next reboot by router-apply.

Remote access: an MCP server (POST /mcp) and an OpenAPI REST API
(/api/v1, /api/openapi.json) with the same tokens, scopes, limits and audit
log; tools to read status, settings, leases, logs (get_logs), and to edit
and check the saved settings (never applied). Tokens on the API access page.

Firewall: a reserved `local` zone (the router itself) as the destination of
rules, so the web UI or SSH can be allowed from the WAN.

PLAN.md lists what is still left.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

pkgs/router-webui/dashboard_test.go

@@ -201,3 +201,35 @@ func keys(m map[string]string) []string {
 	}
 	return out
 }
+
+func TestTheme(t *testing.T) {
+	a, sys := newTestApp(t)
+	h := a.routes()
+	cookie := login(t, h)
+	token := csrfFrom(t, do(h, "GET", "/advanced", nil, cookie).Body.String())
+	has := func(path, want string, ck *http.Cookie) bool {
+		return strings.Contains(do(h, "GET", path, nil, ck).Body.String(), want)
+	}
+	if has("/advanced", "data-theme", cookie) || !has("/login", "<body class=\"bare\"", nil) {
+		t.Fatal("default must follow the browser; the login page has no sidebar")
+	}
+	save := func(theme string) {
+		do(h, "POST", "/prefs", url.Values{"csrf": {token}, "theme": {theme}}, cookie)
+	}
+	save("dark")
+	if sys.loadPrefs().Theme != "dark" || !has("/", `data-theme="dark"`, cookie) || !has("/login", `data-theme="dark"`, nil) {
+		t.Fatal("dark not applied")
+	}
+	save("neon")
+	if sys.loadPrefs().Theme != "dark" {
+		t.Fatal("an unknown theme was stored")
+	}
+	do(h, "POST", "/prefs", url.Values{"csrf": {token}, "pingTargets": {"1.1.1.1"}}, cookie)
+	if sys.loadPrefs().Theme != "dark" {
+		t.Fatal("saving the ping targets dropped the theme")
+	}
+	save("")
+	if has("/advanced", "data-theme", cookie) {
+		t.Fatal("automatic not restored")
+	}
+}