Add signed updates from a bundle or a URL

router-release signs a release as a binary cache; router-update verifies
it against the router's update keys, migrates settings.json, and applies
it with commit-confirm. Includes the web UI page and a VM test.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

pkgs/router-migrate.nix

@@ -0,0 +1,32 @@
+# router-migrate-settings RELEASE FILE: bring a settings.json up to the
+# schema of a release by running its migrations/N.jq in order.
+{
+  writeShellApplication,
+  coreutils,
+  jq,
+}:
+writeShellApplication {
+  name = "router-migrate-settings";
+  runtimeInputs = [
+    coreutils
+    jq
+  ];
+  text = ''
+    [ $# -eq 2 ] || { echo "usage: router-migrate-settings RELEASE SETTINGS.json" >&2; exit 2; }
+    release=$1 file=$2
+    schema=$(cat "$release/schema")
+    version=$(jq -r '.version // 0' "$file")
+    if [ "$version" -gt "$schema" ]; then
+      echo "the settings are at version $version, newer than this release ($schema)" >&2
+      exit 1
+    fi
+    while [ "$version" -lt "$schema" ]; do
+      next=$((version + 1))
+      echo "migrating the settings to version $next"
+      jq -f "$release/migrations/$next.jq" "$file" | jq --argjson v "$next" '.version = $v' > "$file.new"
+      chmod 0600 "$file.new"
+      mv "$file.new" "$file"
+      version=$next
+    done
+  '';
+}