Add MVP router flake with VM test and tmux lab

router.* schema (wan, lans, dns.forwarders) compiled to systemd-networkd,
a generated nftables ruleset with NAT, Kea DHCPv4 and Unbound, plus build-time
assertions against lock-out and interface conflicts.

tests/basic.nix is a three-node VM test (upstream/router/client) covering WAN
DHCP, LAN DHCP and DNS, NAT, WAN-deny and LAN SSH/ping. `nix run .#lab` boots
the same topology in tmux with one console pane per VM and the driver REPL.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

modules/router/dhcp.nix

@@ -0,0 +1,35 @@
+{ config, lib, ... }:
+let
+  cfg = config.router;
+  dhcpLans = lib.filter (l: l.dhcp.enable) (lib.attrValues cfg.lans);
+in
+{
+  config = lib.mkIf (cfg.enable && dhcpLans != [ ]) {
+    services.kea.dhcp4 = {
+      enable = true;
+      settings = {
+        interfaces-config = {
+          interfaces = map (l: l.interface) dhcpLans;
+          # Interfaces are configured asynchronously by networkd.
+          re-detect = true;
+        };
+        lease-database = {
+          type = "memfile";
+          persist = true;
+          name = "/var/lib/kea/dhcp4.leases";
+        };
+        valid-lifetime = 3600;
+        subnet4 = lib.imap1 (id: l: {
+          inherit id;
+          inherit (l.ipv4) subnet;
+          interface = l.interface;
+          pools = [ { pool = "${l.dhcp.pool.start} - ${l.dhcp.pool.end}"; } ];
+          option-data = [
+            { name = "routers"; data = l.ipv4.address; }
+            { name = "domain-name-servers"; data = l.ipv4.address; }
+          ];
+        }) dhcpLans;
+      };
+    };
+  };
+}