Add the appliance web UI look, interface names, MCP and REST API, local zone

Web UI: dark/light themes (appliance layout, sidebar, switch checkboxes),
theme preference on the Advanced page, Changes page with the pending diff.

Interface names: router.interfaces.<name>.mac, lans.<l>.deviceName and
pppoe.vlanName; a rename is staged for the next reboot by router-apply.

Remote access: an MCP server (POST /mcp) and an OpenAPI REST API
(/api/v1, /api/openapi.json) with the same tokens, scopes, limits and audit
log; tools to read status, settings, leases, logs (get_logs), and to edit
and check the saved settings (never applied). Tokens on the API access page.

Firewall: a reserved `local` zone (the router itself) as the destination of
rules, so the web UI or SSH can be allowed from the WAN.

PLAN.md lists what is still left.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

pkgs/router-webui/tokens_ui.go

@@ -0,0 +1,55 @@
+package main
+
+import (
+	"net/http"
+	"net/url"
+	"strings"
+)
+
+type tokensData struct {
+	Tokens []Token
+	Audit  []AuditEntry
+	URL    string // the endpoint, for the example
+	Secret string // a token made just now: shown once
+	Name   string
+	HasDoc bool
+}
+
+func (a *app) tokensData(r *http.Request) tokensData {
+	return tokensData{Tokens: a.tokens.List(), Audit: a.sys.RecentAudit(30), URL: "https://" + r.Host + "/mcp", HasDoc: a.optionsFile != ""}
+}
+
+func (a *app) tokensPage(w http.ResponseWriter, r *http.Request, sess session) {
+	a.render(w, "tokens", page{Title: "API access", CSRF: sess.csrf, LoggedIn: true, Flash: r.URL.Query().Get("msg"), Data: a.tokensData(r)})
+}
+
+func (a *app) tokenCreate(w http.ResponseWriter, r *http.Request, sess session) {
+	tok, secret, err := a.tokens.Create(r.PostFormValue("name"), r.PostFormValue("scope"))
+	p := page{Title: "API access", CSRF: sess.csrf, LoggedIn: true}
+	d := a.tokensData(r)
+	if err != nil {
+		p.Error = err.Error()
+		w.WriteHeader(http.StatusUnprocessableEntity)
+	} else {
+		d.Secret, d.Name = secret, tok.Name
+		p.Flash = "Token " + tok.Name + " created. Copy it now: it is not shown again."
+	}
+	p.Data = d
+	a.render(w, "tokens", p)
+}
+
+func (a *app) tokenRevoke(w http.ResponseWriter, r *http.Request, _ session) {
+	msg := "Token revoked."
+	if err := a.tokens.Revoke(strings.TrimSpace(r.PostFormValue("id"))); err != nil {
+		msg = "Could not revoke: " + err.Error()
+	}
+	http.Redirect(w, r, "/tokens?msg="+url.QueryEscape(msg), http.StatusSeeOther)
+}
+
+// changesPage shows what differs between the confirmed settings and the saved
+// ones, for a person to review before applying.
+func (a *app) changesPage(w http.ResponseWriter, r *http.Request, sess session) {
+	a.render(w, "changes", page{Title: "Changes", CSRF: sess.csrf, LoggedIn: true, Data: map[string]any{
+		"Diff": a.sys.pendingChanges(), "Unapplied": a.sys.Status().Unapplied,
+	}})
+}