Add WireGuard, DNS and more to the web UI and router-setup

Web UI: a WireGuard page (tunnels, peers, keys made on the router, client
configs with a QR code, import of wg-quick configs, live status), a DNS page
(records, wildcards, forward zones), interface dropdowns with VLAN devices,
IPv6 options and a local domain. router-setup asks about VLANs, IPv6 and
the domain. The router publishes its own name in DNS and hands the local
domain to DHCP clients; wg and jq are on the router. Includes a script
that takes over antigua's tunnels.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

modules/settings/default.nix

@@ -125,6 +125,8 @@ in
     environment.systemPackages = [
       apply
       webui
+      pkgs.jq # for looking at and editing settings.json by hand
+      pkgs.wireguard-tools # wg: the tunnels' state, from a shell
     ];
 
     # The web UI starts these rather than running anything itself, so a switch
@@ -156,10 +158,13 @@ in
       description = "Router web UI";
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
-      # iproute2: the dashboard reads the default route and the PPP peer.
+      # iproute2: the dashboard reads the default route and the PPP peer;
+      # wireguard-tools: the tunnels' status; qrencode: client configs.
       path = [
         config.systemd.package
         pkgs.iproute2
+        pkgs.wireguard-tools
+        pkgs.qrencode
       ];
       serviceConfig = {
         ExecStart = "${lib.getExe webui} -listen :${toString cfg.webui.port} -config ${cfg.directory} -state ${cfg.stateDirectory}";