Add a web UI for settings-configured routers

router-webui (Go, standard library only) edits settings.json: host
name, WAN (DHCP or PPPoE), LANs with DHCP, and the raw JSON for the
rest; keys the forms do not know are kept. It applies and confirms by
starting router-apply.service and router-confirm.service, which a
switch never restarts, and shows the build log and the rollback
countdown. HTTPS with a self-signed certificate, a PBKDF2 password
hash, CSRF tokens and an Origin check; reachable from management LANs
only (new router.managementPorts).

router-apply records the settings it built and router-confirm keeps
them as settings.confirmed.json (new rollback.onConfirm hook), so the
UI can tell unapplied changes and discard them.

checks.apply now also logs in from a LAN client, discards the change
left by the rollback, edits the DHCP pool, applies and confirms.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

pkgs/router-webui/templates/network.html

@@ -0,0 +1,64 @@
+{{define "content"}}
+{{with .Data}}
+{{$e := .Errors}}
+<form method="post" action="/network">
+  <input type="hidden" name="csrf" value="{{$.CSRF}}">
+  <datalist id="ifaces">{{range .Interfaces}}<option value="{{.}}">{{end}}</datalist>
+
+  <fieldset>
+    <legend>System</legend>
+    <label>Host name <input name="hostName" value="{{.Form.HostName}}"></label>
+    {{with index $e "hostName"}}<span class="field-error">{{.}}</span>{{end}}
+  </fieldset>
+
+  <fieldset>
+    <legend>Uplink (WAN)</legend>
+    <label>Interface <input name="wan.interface" list="ifaces" value="{{.Form.WAN.Interface}}" required></label>
+    {{with index $e "wan.interface"}}<span class="field-error">{{.}}</span>{{end}}
+    <label>Type
+      <select name="wan.type">
+        <option value="dhcp" {{if eq .Form.WAN.Type "dhcp"}}selected{{end}}>DHCP</option>
+        <option value="pppoe" {{if eq .Form.WAN.Type "pppoe"}}selected{{end}}>PPPoE</option>
+      </select>
+    </label>
+    <div class="sub">
+      <p class="hint">PPPoE only:</p>
+      <label>Username <input name="wan.pppoe.username" value="{{.Form.WAN.PPPoEUser}}" autocomplete="off"></label>
+      {{with index $e "wan.pppoe.username"}}<span class="field-error">{{.}}</span>{{end}}
+      <label>Password <input type="password" name="wan.pppoe.password" autocomplete="new-password"
+        placeholder="{{if .Form.WAN.PasswordSet}}stored — leave empty to keep{{end}}"></label>
+      {{with index $e "wan.pppoe.password"}}<span class="field-error">{{.}}</span>{{end}}
+      <label>VLAN <input name="wan.pppoe.vlan" value="{{.Form.WAN.PPPoEVLAN}}" inputmode="numeric" placeholder="untagged"></label>
+      {{with index $e "wan.pppoe.vlan"}}<span class="field-error">{{.}}</span>{{end}}
+    </div>
+  </fieldset>
+
+  <fieldset>
+    <legend>LANs</legend>
+    {{with index $e "lans"}}<p class="field-error">{{.}}</p>{{end}}
+    <input type="hidden" name="lans" value="{{len .Form.LANs}}">
+    <table>
+      <tr><th>Name</th><th>Interface</th><th>VLAN</th><th>Address</th><th>Prefix</th><th>Internet</th><th>DHCP</th><th>Pool start</th><th>Pool end</th><th>Remove</th></tr>
+      {{range $i, $l := .Form.LANs}}
+      <tr>
+        <td><input name="lan.{{$i}}.name" value="{{$l.Name}}" size="8" placeholder="new"></td>
+        <td><input name="lan.{{$i}}.interface" list="ifaces" value="{{$l.Interface}}" size="8"></td>
+        <td><input name="lan.{{$i}}.vlan" value="{{$l.VLAN}}" size="4" inputmode="numeric"></td>
+        <td><input name="lan.{{$i}}.address" value="{{$l.Address}}" size="13"></td>
+        <td><input name="lan.{{$i}}.prefix" value="{{$l.Prefix}}" size="2" inputmode="numeric" placeholder="24"></td>
+        <td><input type="checkbox" name="lan.{{$i}}.internet" {{if $l.Internet}}checked{{end}}></td>
+        <td><input type="checkbox" name="lan.{{$i}}.dhcp" {{if $l.DHCP}}checked{{end}}></td>
+        <td><input name="lan.{{$i}}.poolStart" value="{{$l.PoolStart}}" size="13"></td>
+        <td><input name="lan.{{$i}}.poolEnd" value="{{$l.PoolEnd}}" size="13"></td>
+        <td>{{if $l.Name}}<input type="checkbox" name="lan.{{$i}}.remove">{{end}}</td>
+      </tr>
+      {{range $f := list "name" "interface" "vlan" "address" "prefix" "poolStart" "poolEnd"}}{{with index $e (printf "lans[%d].%s" $i $f)}}<tr><td colspan="10" class="field-error">{{$f}}: {{.}}</td></tr>{{end}}{{end}}
+      {{end}}
+    </table>
+    <p class="hint">Fill in the last row to add a LAN. Other LAN settings (IPv6, reservations, zones) are kept; edit them under Advanced.</p>
+  </fieldset>
+
+  <button>Save</button>
+</form>
+{{end}}
+{{end}}