Add a web UI for settings-configured routers

router-webui (Go, standard library only) edits settings.json: host
name, WAN (DHCP or PPPoE), LANs with DHCP, and the raw JSON for the
rest; keys the forms do not know are kept. It applies and confirms by
starting router-apply.service and router-confirm.service, which a
switch never restarts, and shows the build log and the rollback
countdown. HTTPS with a self-signed certificate, a PBKDF2 password
hash, CSRF tokens and an Origin check; reachable from management LANs
only (new router.managementPorts).

router-apply records the settings it built and router-confirm keeps
them as settings.confirmed.json (new rollback.onConfirm hook), so the
UI can tell unapplied changes and discard them.

checks.apply now also logs in from a LAN client, discards the change
left by the rollback, edits the DHCP pool, applies and confirms.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

modules/router/firewall.nix

@@ -226,7 +226,9 @@ in
             } } accept # wireguard"
           }
           ${lib.optionalString (dhcpIfaces != [ ]) "iifname ${set dhcpIfaces} udp dport 67 accept"}
-          ${lib.optionalString (mgmtIfaces != [ ]) "iifname ${set mgmtIfaces} tcp dport 22 accept"}
+          ${lib.optionalString (mgmtIfaces != [ ]) "iifname ${set mgmtIfaces} tcp dport { ${
+              lib.concatMapStringsSep ", " toString ([ 22 ] ++ config.router.managementPorts)
+            } } accept"}
         }
 
         chain forward {

modules/router/options.nix

@@ -481,6 +481,16 @@ in
       );
     };
 
+    managementPorts = mkOption {
+      type = types.listOf types.port;
+      default = [ ];
+      example = [ 443 ];
+      description = ''
+        TCP ports on the router, besides SSH, reachable from LANs and tunnels
+        with `allowManagement` (the web UI adds its own).
+      '';
+    };
+
     dns.domain = mkOption {
       type = types.nullOr types.str;
       default = null;

modules/router/rollback.nix

@@ -53,6 +53,7 @@ let
       current=$(readlink -f /run/current-system)
       ${config.nix.package}/bin/nix-env -p ${profile} --set "$current"
       "$current/bin/switch-to-configuration" boot
+      ${cfg.onConfirm}
       echo "router: confirmed $current"
     '';
   };
@@ -64,6 +65,12 @@ in
       default = true;
       description = "Install the commit-confirm helpers `router-arm`, `router-confirm` and `router-rollback`.";
     };
+    onConfirm = lib.mkOption {
+      type = lib.types.lines;
+      default = "";
+      internal = true;
+      description = "Shell commands `router-confirm` runs once the current system is confirmed.";
+    };
     timeout = lib.mkOption {
       type = lib.types.str;
       default = "5min";