Add a static ULA per LAN, announced via SLAAC and RDNSS

lans.<n>.ipv6.address (a ULA /64) is assigned to the LAN, announced
with an explicit prefix (networkd only announces the delegated prefix
when prefix delegation is on) and advertised as RDNSS; Unbound listens
and answers on it. Checked at build time: valid IPv6 CIDR, /64, fc00::/7.

Covered by the onestick VM test (client SLAAC address, ping and DNS over
the ULA, RA captured on the wire), assertion cases and a unit test for
the /64 prefix helper.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tests/assertions.nix

@@ -979,6 +979,26 @@ let
         "also used by a LAN"
       ];
     };
+    ulaValid = {
+      router.lans.main = lan { ipv6.address = "fd2c:cdef:cde9::1/64"; };
+      expect = [ ];
+    };
+    ulaNotUla = {
+      router.lans.main = lan { ipv6.address = "2001:db8::1/64"; };
+      expect = [ "unique-local" ];
+    };
+    ulaNot64 = {
+      router.lans.main = lan { ipv6.address = "fd2c:cdef:cde9::1/48"; };
+      expect = [ "must be a /64" ];
+    };
+    ulaGarbage = {
+      router.lans.main = lan { ipv6.address = "nonsense"; };
+      expect = [ "not an IPv6 address in CIDR" ];
+    };
+    ulaIpv4 = {
+      router.lans.main = lan { ipv6.address = "192.168.1.1/24"; };
+      expect = [ "not an IPv6 address in CIDR" ];
+    };
     nonOverlappingLans = {
       router.lans = {
         a = lan { };
@@ -1028,6 +1048,7 @@ let
     "wanValid"
     "sharedLinkValid"
     "pppTransportValid"
+    "ulaValid"
     "dnsValid"
   ];