Add the appliance web UI look, interface names, MCP and REST API, local zone

Web UI: dark/light themes (appliance layout, sidebar, switch checkboxes),
theme preference on the Advanced page, Changes page with the pending diff.

Interface names: router.interfaces.<name>.mac, lans.<l>.deviceName and
pppoe.vlanName; a rename is staged for the next reboot by router-apply.

Remote access: an MCP server (POST /mcp) and an OpenAPI REST API
(/api/v1, /api/openapi.json) with the same tokens, scopes, limits and audit
log; tools to read status, settings, leases, logs (get_logs), and to edit
and check the saved settings (never applied). Tokens on the API access page.

Firewall: a reserved `local` zone (the router itself) as the destination of
rules, so the web UI or SSH can be allowed from the WAN.

PLAN.md lists what is still left.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

pkgs/router-webui/settings.go

@@ -276,6 +276,10 @@ type Device struct {
 	Kind      string // "physical" or "VLAN"
 	Role      string // "WAN", "LAN lan", or ""
 	Removable bool   // a VLAN defined in the UI that nothing uses
+	// Set by the app from the machine and the settings.
+	Kernel string // physical: the name the kernel gives the card now
+	MAC    string // physical: of the card, when it is on this machine
+	Custom string // VLAN: the name chosen for its device
 }
 
 // devices lists the physical interfaces plus the VLAN devices the settings
@@ -377,6 +381,7 @@ func (s Settings) apply(f Form, passwordFile string) (string, error) {
 			pppoe["vlan"] = wanVLAN
 		} else {
 			delete(pppoe, "vlan")
+			delete(pppoe, "vlanName")
 		}
 		if f.WAN.PPPoEPassword != "" {
 			pppoe["passwordFile"] = passwordFile
@@ -431,6 +436,7 @@ func (s Settings) apply(f Form, passwordFile string) (string, error) {
 			l["vlan"] = lanVLAN
 		} else {
 			delete(l, "vlan")
+			delete(l, "deviceName")
 		}
 		l["internet"] = lf.Internet
 		if lf.IPv6PD {