Add token expiry, edit notice, log allowlist, local-zone test; merge PLAN.md into SPECS.md

get_logs needs a unit from an allowlist (router-*, kea, unbound, networkd,
nftables, ddclient, acme, sshd, kernel). API tokens are valid for 1, 7, 30
(default) or 90 days, or without limit. The overview and the Changes page
say which token made the unapplied changes.

options.json (router://options) no longer holds the options' source paths:
they differ between builds of a release, so a router rebuilding itself
offline had to build the file and failed (found by the update test).

Web UI: panels flow into columns on wide screens and the width is no longer
capped; on phones the navigation is a menu button; the Advanced page uses
panels; VLAN dropdowns show their chosen names; the duplicate WireGuard
heading is gone.

basic: a subtest for wan -> local rules.

SPECS.md is now the only document (decisions, how each part works, and what
is not done yet); PLAN.md is gone.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

pkgs/router-webui/templates/advanced.html

@@ -1,5 +1,5 @@
 {{define "content"}}
-<section>
+<section class="panel">
 <h2>Settings</h2>
 <p>The complete settings: the <code>router</code> options of nixos-router as JSON, plus <code>system</code>.
    They are checked when applied; nothing changes until then.</p>
@@ -10,7 +10,9 @@
 </form>
 </section>
 
-<section>
+<div class="cols">
+
+<section class="panel">
 <h2>Appearance</h2>
 <form method="post" action="/prefs" class="narrow">
   <input type="hidden" name="csrf" value="{{.CSRF}}">
@@ -26,7 +28,7 @@
 </form>
 </section>
 
-<section>
+<section class="panel">
 <h2>Dashboard</h2>
 <form method="post" action="/prefs" class="narrow">
   <input type="hidden" name="csrf" value="{{.CSRF}}">
@@ -37,7 +39,7 @@
 </form>
 </section>
 
-<section>
+<section class="panel">
 <h2>Password</h2>
 <p>One password for this web UI and for root on the console and over SSH.</p>
 <form method="post" action="/password" class="narrow">
@@ -49,17 +51,18 @@
 </form>
 </section>
 
-<section>
+<section class="panel">
 <h2>Reboot</h2>
 <p>Restarts the router; routing stops for a minute or two. A new kernel from an update only runs after this.</p>
 <form method="post" action="/reboot" data-confirm="Reboot the router now?"><input type="hidden" name="csrf" value="{{.CSRF}}"><button>Reboot</button></form>
 </section>
 
-<section>
+<section class="panel">
 <h2>Backup</h2>
 <p>Everything on <code>/var/lib/router</code>: settings, PPPoE password, WireGuard keys, passwords, the web UI's
    certificate and the dashboard history. Keep the file safe. To restore, put it on a USB stick and run
    <code>router-setup</code> from the installer: it offers to install from it.</p>
 <form method="post" action="/backup"><input type="hidden" name="csrf" value="{{.CSRF}}"><button>Download backup</button></form>
 </section>
+</div>
 {{end}}