Add DNS accounts, Let's Encrypt, password change, reboot, HTTP redirect

- router.dnsProviders: named accounts at DNS providers, used by dynamic
  DNS and certificates (ddclient and lego provider lists in
  pkgs/router-webui/providers.json). Schema 2 migrates router.ddns.
- router.acme: a Let's Encrypt certificate for the web UI via
  security.acme (DNS-01, resolver 1.1.1.1), served and reloaded by the
  web UI; Certificate page.
- Web UI: password change (web UI and root), reboot button, HTTP to HTTPS
  redirect (router.webui.httpPort), grouped menu.
- Latest kernel (linuxPackages_latest); 7.3 and 7.3.0 are the same kernel
  for the reboot hint.
- SPECS.md: wanted later (REST API, GraphQL, MCP).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

pkgs/router-webui/templates/advanced.html

@@ -21,6 +21,24 @@
 </form>
 </section>
 
+<section>
+<h2>Password</h2>
+<p>One password for this web UI and for root on the console and over SSH.</p>
+<form method="post" action="/password" class="narrow">
+  <input type="hidden" name="csrf" value="{{.CSRF}}">
+  <label>Current password <input type="password" name="current" autocomplete="current-password" required></label>
+  <label>New password (at least 8 characters) <input type="password" name="new" autocomplete="new-password" minlength="8" required></label>
+  <label>New password again <input type="password" name="confirm" autocomplete="new-password" minlength="8" required></label>
+  <button>Change password</button>
+</form>
+</section>
+
+<section>
+<h2>Reboot</h2>
+<p>Restarts the router; routing stops for a minute or two. A new kernel from an update only runs after this.</p>
+<form method="post" action="/reboot" data-confirm="Reboot the router now?"><input type="hidden" name="csrf" value="{{.CSRF}}"><button>Reboot</button></form>
+</section>
+
 <section>
 <h2>Backup</h2>
 <p>Everything on <code>/var/lib/router</code>: settings, PPPoE password, WireGuard keys, passwords, the web UI's