Add DNS accounts, Let's Encrypt, password change, reboot, HTTP redirect

- router.dnsProviders: named accounts at DNS providers, used by dynamic
  DNS and certificates (ddclient and lego provider lists in
  pkgs/router-webui/providers.json). Schema 2 migrates router.ddns.
- router.acme: a Let's Encrypt certificate for the web UI via
  security.acme (DNS-01, resolver 1.1.1.1), served and reloaded by the
  web UI; Certificate page.
- Web UI: password change (web UI and root), reboot button, HTTP to HTTPS
  redirect (router.webui.httpPort), grouped menu.
- Latest kernel (linuxPackages_latest); 7.3 and 7.3.0 are the same kernel
  for the reboot hint.
- SPECS.md: wanted later (REST API, GraphQL, MCP).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

tests/ddns.nix

@@ -67,13 +67,16 @@ pkgs.testers.runNixOSTest {
               end = "192.168.10.199";
             };
           };
+          dnsProviders.provider = {
+            type = "dyndns2";
+            server = "203.0.113.1";
+            username = "router";
+            secretFile = "/run/ddns-secret";
+          };
           ddns = {
             enable = true;
-            protocol = "dyndns2";
-            server = "203.0.113.1";
+            provider = "provider";
             ssl = false;
-            username = "router";
-            passwordFile = "/run/ddns-secret";
             domains = [
               "home.example.test"
               "vpn.example.test"
@@ -99,9 +102,9 @@ pkgs.testers.runNixOSTest {
 
     with subtest("the first address is published, for every name"):
         upstream.wait_until_succeeds(updated("203.0.113.100"), timeout=90)
-        out = upstream.succeed("cat /var/log/nginx/access.log")
+        # One request for all names or one each, depending on the provider's answer.
         for name in ("home.example.test", "vpn.example.test"):
-            assert f"hostname={name}" in out or name in out, out
+            upstream.wait_until_succeeds(f"grep -q '{name}.*myip=203.0.113.100' /var/log/nginx/access.log", timeout=30)
         # The login arrives as basic auth, not in the URL, and the secret stays off the command line.
         router.fail("grep -r hunter2 /etc/ddclient* /nix/store/*ddclient.conf 2>/dev/null")