Add MVP router flake with VM test and tmux lab

router.* schema (wan, lans, dns.forwarders) compiled to systemd-networkd,
a generated nftables ruleset with NAT, Kea DHCPv4 and Unbound, plus build-time
assertions against lock-out and interface conflicts.

tests/basic.nix is a three-node VM test (upstream/router/client) covering WAN
DHCP, LAN DHCP and DNS, NAT, WAN-deny and LAN SSH/ping. `nix run .#lab` boots
the same topology in tmux with one console pane per VM and the driver REPL.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

modules/router/assertions.nix

@@ -0,0 +1,31 @@
+{ config, lib, ... }:
+let
+  cfg = config.router;
+  lans = lib.attrValues cfg.lans;
+in
+{
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = lans != [ ];
+        message = "router: at least one LAN must be defined.";
+      }
+      {
+        assertion = lib.any (l: l.allowManagement) lans;
+        message = "router: no LAN has allowManagement = true; you would be locked out of the router.";
+      }
+      {
+        assertion = !(lib.elem cfg.wan.interface (map (l: l.interface) lans));
+        message = "router: the WAN interface `${cfg.wan.interface}` is also used by a LAN.";
+      }
+      {
+        assertion =
+          let
+            ifaces = map (l: l.interface) lans;
+          in
+          lib.length ifaces == lib.length (lib.unique ifaces);
+        message = "router: two LANs share the same interface.";
+      }
+    ];
+  };
+}