Add a static ULA per LAN, announced via SLAAC and RDNSS

lans.<n>.ipv6.address (a ULA /64) is assigned to the LAN, announced
with an explicit prefix (networkd only announces the delegated prefix
when prefix delegation is on) and advertised as RDNSS; Unbound listens
and answers on it. Checked at build time: valid IPv6 CIDR, /64, fc00::/7.

Covered by the onestick VM test (client SLAAC address, ping and DNS over
the ULA, RA captured on the wire), assertion cases and a unit test for
the /64 prefix helper.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

modules/router/lib.nix

@@ -62,4 +62,20 @@ rec {
       in
       networkOf a.address p == networkOf b.address p;
   };
+
+  ipv6 = {
+    # The first 64 bits of an address (any form, with or without a prefix
+    # length) as a /64 prefix, e.g. fd2c:cdef:cde9::1/64 -> fd2c:cdef:cde9:0::/64.
+    prefix64 =
+      address:
+      let
+        bare = builtins.head (lib.splitString "/" address);
+        halves = lib.splitString "::" bare;
+        groups = s: lib.filter (g: g != "") (lib.splitString ":" s);
+        head = groups (builtins.elemAt halves 0);
+        tail = lib.optionals (lib.length halves > 1) (groups (builtins.elemAt halves 1));
+        full = head ++ lib.replicate (8 - lib.length head - lib.length tail) "0" ++ tail;
+      in
+      "${lib.concatStringsSep ":" (lib.take 4 full)}::/64";
+  };
 }