Add MVP router flake with VM test and tmux lab

router.* schema (wan, lans, dns.forwarders) compiled to systemd-networkd,
a generated nftables ruleset with NAT, Kea DHCPv4 and Unbound, plus build-time
assertions against lock-out and interface conflicts.

tests/basic.nix is a three-node VM test (upstream/router/client) covering WAN
DHCP, LAN DHCP and DNS, NAT, WAN-deny and LAN SSH/ping. `nix run .#lab` boots
the same topology in tmux with one console pane per VM and the driver REPL.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

modules/router/dns.nix

@@ -0,0 +1,29 @@
+{ config, lib, ... }:
+let
+  cfg = config.router;
+  lans = lib.attrValues cfg.lans;
+in
+{
+  config = lib.mkIf cfg.enable {
+    services.unbound = {
+      enable = true;
+      settings = {
+        server = {
+          interface = [ "127.0.0.1" ] ++ map (l: l.ipv4.address) lans;
+          # LAN addresses are assigned by networkd, possibly after Unbound starts.
+          ip-freebind = true;
+          access-control = [
+            "127.0.0.0/8 allow"
+          ] ++ map (l: "${l.ipv4.subnet} allow") lans;
+        };
+      } // lib.optionalAttrs (cfg.dns.forwarders != [ ]) {
+        forward-zone = [
+          {
+            name = ".";
+            forward-addr = cfg.dns.forwarders;
+          }
+        ];
+      };
+    };
+  };
+}