Derive LAN subnets and validate addressing at build time

Add an IPv4 helper lib (parse, netmask, cidr, overlap) and derive
router.lans.<name>.ipv4.subnet from address and prefixLength instead of
requiring it twice. New assertions reject invalid addresses, DHCP pools that
are reversed, outside the subnet or contain the router address, and
overlapping LANs.

Add `lib` unit tests and an `assertions` check that evaluates broken configs
and compares the exact error messages.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tests/basic.nix

@@ -62,7 +62,7 @@ pkgs.testers.runNixOSTest {
         wan.interface = "eth1";
         lans.main = {
           interface = "eth2";
-          ipv4 = { address = "192.168.10.1"; subnet = "192.168.10.0/24"; };
+          ipv4 = { address = "192.168.10.1"; };
           dhcp.pool = { start = "192.168.10.100"; end = "192.168.10.199"; };
         };
         dns.forwarders = [ "203.0.113.1" ];