Add a web UI for settings-configured routers

router-webui (Go, standard library only) edits settings.json: host
name, WAN (DHCP or PPPoE), LANs with DHCP, and the raw JSON for the
rest; keys the forms do not know are kept. It applies and confirms by
starting router-apply.service and router-confirm.service, which a
switch never restarts, and shows the build log and the rollback
countdown. HTTPS with a self-signed certificate, a PBKDF2 password
hash, CSRF tokens and an Origin check; reachable from management LANs
only (new router.managementPorts).

router-apply records the settings it built and router-confirm keeps
them as settings.confirmed.json (new rollback.onConfirm hook), so the
UI can tell unapplied changes and discard them.

checks.apply now also logs in from a LAN client, discards the change
left by the rollback, edits the DHCP pool, applies and confirms.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

pkgs/router-webui/package.nix

@@ -0,0 +1,20 @@
+{ lib, buildGo127Module }:
+buildGo127Module {
+  pname = "router-webui";
+  version = "0.1.0";
+  src = lib.fileset.toSource {
+    root = ./.;
+    fileset = lib.fileset.unions [
+      ./go.mod
+      (lib.fileset.fileFilter (f: f.hasExt "go") ./.)
+      ./templates
+      ./static
+    ];
+  };
+  # Standard library only.
+  vendorHash = null;
+  meta = {
+    description = "Web UI for a nixos-router configured by settings.json";
+    mainProgram = "router-webui";
+  };
+}