Add WireGuard, DNS and more to the web UI and router-setup

Web UI: a WireGuard page (tunnels, peers, keys made on the router, client
configs with a QR code, import of wg-quick configs, live status), a DNS page
(records, wildcards, forward zones), interface dropdowns with VLAN devices,
IPv6 options and a local domain. router-setup asks about VLANs, IPv6 and
the domain. The router publishes its own name in DNS and hands the local
domain to DHCP clients; wg and jq are on the router. Includes a script
that takes over antigua's tunnels.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

tests/setup.nix

@@ -37,6 +37,7 @@ let
     dhcp
     n
     gw
+
     192.168.10.1
     hunter2hunter2
     hunter2hunter2
@@ -58,6 +59,8 @@ let
     pppoe-secret
 
     gw
+    Home.test
+    home.test
     192.168.10.1
     hunter2hunter2
     hunter2hunter2
@@ -128,7 +131,7 @@ pkgs.testers.runNixOSTest {
     installer.wait_for_unit("multi-user.target")
 
     with subtest("router-setup refuses to install without the disk name"):
-        installer.fail("printf '/dev/vda\\nn\\neth1\\neth2\\ndhcp\\nn\\n\\n\\nhunter2hunter2\\nhunter2hunter2\\n\\nno\\n' | router-setup")
+        installer.fail("printf '/dev/vda\\nn\\neth1\\neth2\\ndhcp\\nn\\n\\n\\n\\nhunter2hunter2\\nhunter2hunter2\\n\\nno\\n' | router-setup")
         installer.fail("blkid /dev/vda1")
 
     with subtest("router-setup writes a PPPoE uplink on a VLAN, shared with the LAN, with IPv6"):
@@ -142,6 +145,7 @@ pkgs.testers.runNixOSTest {
         assert r["wan"]["ipv6"] == {"enable": True, "transport": "ppp"}, s
         assert r["lans"]["lan"]["interface"] == "eth1" and r["lans"]["lan"]["ipv6"] == {"pd": True}, s
         assert "vlan" not in r["lans"]["lan"], s
+        assert r["dns"]["domain"] == "home.test", s
         assert "pppoe-secret" not in s
         installer.succeed("grep -qx pppoe-secret /tmp/vlan-config/pppoe-password")
         installer.fail("blkid /dev/vda1")