Add token expiry, edit notice, log allowlist, local-zone test; merge PLAN.md into SPECS.md

get_logs needs a unit from an allowlist (router-*, kea, unbound, networkd,
nftables, ddclient, acme, sshd, kernel). API tokens are valid for 1, 7, 30
(default) or 90 days, or without limit. The overview and the Changes page
say which token made the unapplied changes.

options.json (router://options) no longer holds the options' source paths:
they differ between builds of a release, so a router rebuilding itself
offline had to build the file and failed (found by the update test).

Web UI: panels flow into columns on wide screens and the width is no longer
capped; on phones the navigation is a menu button; the Advanced page uses
panels; VLAN dropdowns show their chosen names; the duplicate WireGuard
heading is gone.

basic: a subtest for wan -> local rules.

SPECS.md is now the only document (decisions, how each part works, and what
is not done yet); PLAN.md is gone.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

pkgs/router-webui/system.go

@@ -59,6 +59,7 @@ type Status struct {
 	Log            string
 	RollbackIn     time.Duration // > 0 while a change awaits confirmation
 	Unapplied      bool          // settings.json differs from the confirmed settings
+	TokenEdit      string        // who edited them through the API, when the saved settings are still that edit
 	ConfirmRunning bool
 }
 
@@ -81,6 +82,9 @@ func (s System) Status() Status {
 	cur, err1 := os.ReadFile(s.settingsPath())
 	conf, err2 := os.ReadFile(s.confirmedPath())
 	st.Unapplied = err1 == nil && err2 == nil && !sameJSON(cur, conf)
+	if st.Unapplied {
+		st.TokenEdit = s.tokenEditNote(cur)
+	}
 	return st
 }