Add a static ULA per LAN, announced via SLAAC and RDNSS

lans.<n>.ipv6.address (a ULA /64) is assigned to the LAN, announced
with an explicit prefix (networkd only announces the delegated prefix
when prefix delegation is on) and advertised as RDNSS; Unbound listens
and answers on it. Checked at build time: valid IPv6 CIDR, /64, fc00::/7.

Covered by the onestick VM test (client SLAAC address, ping and DNS over
the ULA, RA captured on the wire), assertion cases and a unit test for
the /64 prefix helper.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

modules/router/dns.nix

@@ -55,13 +55,19 @@ in
       enable = true;
       settings = {
         server = {
-          interface = [ "127.0.0.1" ] ++ map (l: l.ipv4.address) lans ++ map addrOf dnsAddrs;
+          interface = [
+            "127.0.0.1"
+          ]
+          ++ map (l: l.ipv4.address) lans
+          ++ map (l: addrOf l.ipv6.address) (lib.filter (l: l.ipv6.address != null) lans)
+          ++ map addrOf dnsAddrs;
           # LAN addresses are assigned by networkd, possibly after Unbound starts.
           ip-freebind = true;
           access-control = [
             "127.0.0.0/8 allow"
           ]
           ++ map (l: "${l.ipv4.subnet} allow") lans
+          ++ map (l: "${l.ipv6.address} allow") (lib.filter (l: l.ipv6.address != null) lans)
           ++ map (a: "${netOf a} allow") dnsAddrs
           ++ map (n: "${n} allow") dnsPeerNets;
           local-zone =