Add DNS accounts, Let's Encrypt, password change, reboot, HTTP redirect

- router.dnsProviders: named accounts at DNS providers, used by dynamic
  DNS and certificates (ddclient and lego provider lists in
  pkgs/router-webui/providers.json). Schema 2 migrates router.ddns.
- router.acme: a Let's Encrypt certificate for the web UI via
  security.acme (DNS-01, resolver 1.1.1.1), served and reloaded by the
  web UI; Certificate page.
- Web UI: password change (web UI and root), reboot button, HTTP to HTTPS
  redirect (router.webui.httpPort), grouped menu.
- Latest kernel (linuxPackages_latest); 7.3 and 7.3.0 are the same kernel
  for the reboot hint.
- SPECS.md: wanted later (REST API, GraphQL, MCP).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

pkgs/router-webui/collect.go

@@ -297,7 +297,12 @@ var kernelDirRe = regexp.MustCompile(`-linux-([0-9][^/]*)/`)
 // (a path like /nix/store/…-linux-6.12.5/bzImage) if it is not the running one.
 func pendingKernel(running, image string) string {
 	m := kernelDirRe.FindStringSubmatch(image)
-	if m == nil || running == "" || m[1] == running || strings.HasPrefix(running, m[1]+"-") {
+	if m == nil || running == "" {
+		return ""
+	}
+	// The store name says 7.3, the kernel 7.3.0 (or 7.3.0-suffix).
+	base, _, _ := strings.Cut(running, "-")
+	if base == m[1] || base == m[1]+".0" {
 		return ""
 	}
 	return m[1]