Add DNS accounts, Let's Encrypt, password change, reboot, HTTP redirect

- router.dnsProviders: named accounts at DNS providers, used by dynamic
  DNS and certificates (ddclient and lego provider lists in
  pkgs/router-webui/providers.json). Schema 2 migrates router.ddns.
- router.acme: a Let's Encrypt certificate for the web UI via
  security.acme (DNS-01, resolver 1.1.1.1), served and reloaded by the
  web UI; Certificate page.
- Web UI: password change (web UI and root), reboot button, HTTP to HTTPS
  redirect (router.webui.httpPort), grouped menu.
- Latest kernel (linuxPackages_latest); 7.3 and 7.3.0 are the same kernel
  for the reboot hint.
- SPECS.md: wanted later (REST API, GraphQL, MCP).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

tests/update.nix

@@ -59,18 +59,28 @@ let
     serial = 2000;
     # Settings version 1: the time zone becomes explicit.
     extra = ''
+      rm $out/migrations/*.jq
       echo '.system.timeZone = "Europe/Berlin"' > $out/migrations/1.jq
     '';
   };
 
-  release = v: v.lib.mkRelease {
-    inherit pkgs;
-    # The router has all it needs to rebuild; keep the bundles small.
-    includeReference = false;
-  };
+  release =
+    v:
+    v.lib.mkRelease {
+      inherit pkgs;
+      # The router has all it needs to rebuild; keep the bundles small.
+      includeReference = false;
+    };
   release1 = release v1;
   release2 = release v2;
-  tool = v: r: "${v.lib.mkReleaseTool { inherit pkgs; release = r; }}/bin/router-release";
+  tool =
+    v: r:
+    "${
+      v.lib.mkReleaseTool {
+        inherit pkgs;
+        release = r;
+      }
+    }/bin/router-release";
 
   settings = pkgs.writeText "settings.json" (
     builtins.toJSON {