Add WireGuard, DNS and more to the web UI and router-setup

Web UI: a WireGuard page (tunnels, peers, keys made on the router, client
configs with a QR code, import of wg-quick configs, live status), a DNS page
(records, wildcards, forward zones), interface dropdowns with VLAN devices,
IPv6 options and a local domain. router-setup asks about VLANs, IPv6 and
the domain. The router publishes its own name in DNS and hands the local
domain to DHCP clients; wg and jq are on the router. Includes a script
that takes over antigua's tunnels.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

tests/dns.nix

@@ -143,6 +143,11 @@ pkgs.testers.runNixOSTest {
         assert q("printer.lan.test") == "192.168.10.51"
         assert q("20.10.168.192.in-addr.arpa", "PTR") == "nas.lan.test."
 
+    with subtest("the router's own name resolves, with and without the domain"):
+        assert q("router.lan.test") == "192.168.10.1", q("router.lan.test")
+        assert q("router") == "192.168.10.1", q("router")
+        assert q("1.10.168.192.in-addr.arpa", "PTR") == "router.lan.test."
+
     with subtest("the local domain is authoritative: unknown names are not forwarded"):
         # Positive control: resolving through the router works at all.
         assert q("other.example.test") == "203.0.113.8"