Add signed updates from a bundle or a URL

router-release signs a release as a binary cache; router-update verifies
it against the router's update keys, migrates settings.json, and applies
it with commit-confirm. Includes the web UI page and a VM test.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

modules/router/rollback.nix

@@ -29,6 +29,12 @@ let
     text = ''
       ${confirmed}
       echo "router: rolling back to $(readlink -f "$target")"
+      # A failing hook must not stop the rollback.
+      hook() {
+        :
+        ${cfg.onRollback}
+      }
+      hook || echo "router: a rollback hook failed" >&2
       exec "$target/bin/switch-to-configuration" test
     '';
   };
@@ -71,6 +77,12 @@ in
       internal = true;
       description = "Shell commands `router-confirm` runs once the current system is confirmed.";
     };
+    onRollback = lib.mkOption {
+      type = lib.types.lines;
+      default = "";
+      internal = true;
+      description = "Shell commands `router-rollback` runs before it re-activates the confirmed system.";
+    };
     timeout = lib.mkOption {
       type = lib.types.str;
       default = "5min";