Add IPv6 prefix delegation and PPPoE uplink

IPv6: router.wan.ipv6.enable mirrors the existing uplink config (DHCPv6 with
WithoutRA=solicit, delegated prefix). The ISP delegates a single /64, so
exactly one LAN may claim it via router.lans.<name>.ipv6.pd (asserted); other
LANs stay IPv4-only. SLAAC only, no NAT66.

PPPoE: router.wan.ipv4.type = "pppoe" runs pppd on an optional VLAN of the
uplink, with the password read from a file at service start (never the Nix
store). NAT, forwarding and MSS clamping (MTU 1492) use the derived PPP
device; native IPv6 stays on the untagged link.

Tests: basic.nix is parameterised by uplink type; the pppoe variant uses a
fake ISP with pppoe-server (VLAN 7, CHAP). Both variants cover IPv6 PD, SLAAC,
routing without NAT and WAN-deny. Assertion tests gain PD/PPPoE cases and a
full-system evaluation step.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

modules/router/lib.nix

@@ -33,7 +33,9 @@ rec {
     networkOf = address: prefixLength: builtins.bitAnd address (netMask prefixLength);
 
     # "192.168.10.1" /24 -> "192.168.10.0/24"
-    cidr = address: prefixLength: "${format (networkOf (parse address) prefixLength)}/${toString prefixLength}";
+    cidr =
+      address: prefixLength:
+      "${format (networkOf (parse address) prefixLength)}/${toString prefixLength}";
 
     inSubnet =
       { address, prefixLength }: ip: networkOf ip prefixLength == networkOf address prefixLength;