Add a web UI for settings-configured routers

router-webui (Go, standard library only) edits settings.json: host
name, WAN (DHCP or PPPoE), LANs with DHCP, and the raw JSON for the
rest; keys the forms do not know are kept. It applies and confirms by
starting router-apply.service and router-confirm.service, which a
switch never restarts, and shows the build log and the rollback
countdown. HTTPS with a self-signed certificate, a PBKDF2 password
hash, CSRF tokens and an Origin check; reachable from management LANs
only (new router.managementPorts).

router-apply records the settings it built and router-confirm keeps
them as settings.confirmed.json (new rollback.onConfirm hook), so the
UI can tell unapplied changes and discard them.

checks.apply now also logs in from a LAN client, discards the change
left by the rollback, edits the DHCP pool, applies and confirms.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

pkgs/router-webui/templates/overview.html

@@ -0,0 +1,37 @@
+{{define "content"}}
+{{$s := .Data}}
+<section>
+  <dl>
+    <dt>Running system</dt><dd><code>{{short $s.Current}}</code></dd>
+    <dt>Confirmed system</dt><dd><code>{{short $s.Confirmed}}</code></dd>
+  </dl>
+</section>
+
+{{if $s.Applying}}
+<section class="busy"><h2>Applying…</h2><p>Building the new configuration. This page refreshes on its own.</p></section>
+{{else if $s.ConfirmRunning}}
+<section class="busy"><h2>Confirming…</h2></section>
+{{else if gt (seconds $s.RollbackIn) 0}}
+<section class="pending">
+  <h2>Waiting for confirmation</h2>
+  <p>The new configuration is active. Unless you confirm it within <strong>{{duration $s.RollbackIn}}</strong>,
+     the router goes back to the confirmed system on its own.</p>
+  <form method="post" action="/confirm"><input type="hidden" name="csrf" value="{{.CSRF}}"><button>Confirm</button></form>
+</section>
+{{else}}
+<section>
+  {{if $s.Unapplied}}<p>The settings have changes that are not part of the confirmed system.</p>{{else}}<p>The settings match the confirmed system.</p>{{end}}
+  <div class="actions">
+    <form method="post" action="/apply"><input type="hidden" name="csrf" value="{{.CSRF}}"><button>Apply</button></form>
+    {{if $s.Unapplied}}<form method="post" action="/discard"><input type="hidden" name="csrf" value="{{.CSRF}}"><button class="secondary">Discard changes</button></form>{{end}}
+  </div>
+</section>
+{{end}}
+
+{{if $s.Log}}
+<section>
+  <h2>Last apply{{if $s.ApplyResult}} — {{if eq $s.ApplyResult "success"}}succeeded{{else}}failed ({{$s.ApplyResult}}){{end}}{{end}}</h2>
+  <pre class="log">{{$s.Log}}</pre>
+</section>
+{{end}}
+{{end}}