Add token expiry, edit notice, log allowlist, local-zone test; merge PLAN.md into SPECS.md

get_logs needs a unit from an allowlist (router-*, kea, unbound, networkd,
nftables, ddclient, acme, sshd, kernel). API tokens are valid for 1, 7, 30
(default) or 90 days, or without limit. The overview and the Changes page
say which token made the unapplied changes.

options.json (router://options) no longer holds the options' source paths:
they differ between builds of a release, so a router rebuilding itself
offline had to build the file and failed (found by the update test).

Web UI: panels flow into columns on wide screens and the width is no longer
capped; on phones the navigation is a menu button; the Advanced page uses
panels; VLAN dropdowns show their chosen names; the duplicate WireGuard
heading is gone.

basic: a subtest for wan -> local rules.

SPECS.md is now the only document (decisions, how each part works, and what
is not done yet); PLAN.md is gone.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

pkgs/router-webui/templates/overview.html

@@ -1,4 +1,5 @@
 {{define "content"}}
+<div class="cols">
 {{$s := .Data.Status}}
 {{if $s.Applying}}
 <section class="busy"><h2>Applying…</h2><p>Building the new configuration. This page refreshes on its own.</p></section>
@@ -14,6 +15,7 @@
 {{else if $s.Unapplied}}
 <section class="pending">
   <p>The settings have changes that are not part of the confirmed system. <a href="/changes">Review the changes</a>.</p>
+  {{with $s.TokenEdit}}<p><strong>{{.}}</strong></p>{{end}}
   <div class="actions">
     <form method="post" action="/apply"><input type="hidden" name="csrf" value="{{.CSRF}}"><button>Apply</button></form>
     <form method="post" action="/discard"><input type="hidden" name="csrf" value="{{.CSRF}}"><button class="secondary">Discard changes</button></form>
@@ -44,4 +46,5 @@
 </section>
 {{end}}
 <script src="/static/dashboard.js" defer></script>
+</div>
 {{end}}