Add the appliance web UI look, interface names, MCP and REST API, local zone

Web UI: dark/light themes (appliance layout, sidebar, switch checkboxes),
theme preference on the Advanced page, Changes page with the pending diff.

Interface names: router.interfaces.<name>.mac, lans.<l>.deviceName and
pppoe.vlanName; a rename is staged for the next reboot by router-apply.

Remote access: an MCP server (POST /mcp) and an OpenAPI REST API
(/api/v1, /api/openapi.json) with the same tokens, scopes, limits and audit
log; tools to read status, settings, leases, logs (get_logs), and to edit
and check the saved settings (never applied). Tokens on the API access page.

Firewall: a reserved `local` zone (the router itself) as the destination of
rules, so the web UI or SSH can be allowed from the WAN.

PLAN.md lists what is still left.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

pkgs/router-webui/templates/advanced.html

@@ -10,6 +10,22 @@
 </form>
 </section>
 
+<section>
+<h2>Appearance</h2>
+<form method="post" action="/prefs" class="narrow">
+  <input type="hidden" name="csrf" value="{{.CSRF}}">
+  <label>Theme
+    <select name="theme">
+      <option value="" {{if eq .Data.Theme ""}}selected{{end}}>Automatic (follow the browser or system)</option>
+      <option value="light" {{if eq .Data.Theme "light"}}selected{{end}}>Light</option>
+      <option value="dark" {{if eq .Data.Theme "dark"}}selected{{end}}>Dark</option>
+    </select>
+  </label>
+  <p class="hint">Applies to everyone using this web UI, right away.</p>
+  <button>Save</button>
+</form>
+</section>
+
 <section>
 <h2>Dashboard</h2>
 <form method="post" action="/prefs" class="narrow">