Add DNS accounts, Let's Encrypt, password change, reboot, HTTP redirect

- router.dnsProviders: named accounts at DNS providers, used by dynamic
  DNS and certificates (ddclient and lego provider lists in
  pkgs/router-webui/providers.json). Schema 2 migrates router.ddns.
- router.acme: a Let's Encrypt certificate for the web UI via
  security.acme (DNS-01, resolver 1.1.1.1), served and reloaded by the
  web UI; Certificate page.
- Web UI: password change (web UI and root), reboot button, HTTP to HTTPS
  redirect (router.webui.httpPort), grouped menu.
- Latest kernel (linuxPackages_latest); 7.3 and 7.3.0 are the same kernel
  for the reboot hint.
- SPECS.md: wanted later (REST API, GraphQL, MCP).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

SPECS.md

@@ -0,0 +1,16 @@
+# Specs
+
+What nixos-router should become, beyond what exists. `PLAN.md` records decisions and what is done; this file
+lists wanted features. Nothing here is started.
+
+## Later
+
+### Programmatic access
+
+- **REST API** for everything the web UI does (settings, apply/confirm, status, metrics, updates), versioned and
+  authenticated with tokens rather than the browser session. The web UI would use the same handlers.
+- **GraphQL** on top of it, possibly: one query for the overview and for related settings.
+- **MCP server**, so an assistant can read the router's state and propose or make changes (the same checks as the
+  web UI: settings are validated, applied with commit-confirm rollback, secrets are never returned).
+- To settle first: token scopes (read-only vs. change), audit log, and that changes still go through
+  `settings.json` and `router-apply` rather than touching the live system.