Add MVP router flake with VM test and tmux lab

router.* schema (wan, lans, dns.forwarders) compiled to systemd-networkd,
a generated nftables ruleset with NAT, Kea DHCPv4 and Unbound, plus build-time
assertions against lock-out and interface conflicts.

tests/basic.nix is a three-node VM test (upstream/router/client) covering WAN
DHCP, LAN DHCP and DNS, NAT, WAN-deny and LAN SSH/ping. `nix run .#lab` boots
the same topology in tmux with one console pane per VM and the driver REPL.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

modules/router/networking.nix

@@ -0,0 +1,30 @@
+{ config, lib, ... }:
+let
+  cfg = config.router;
+in
+{
+  config = lib.mkIf cfg.enable {
+    networking.useNetworkd = true;
+    networking.useDHCP = false;
+
+    boot.kernel.sysctl = {
+      "net.ipv4.conf.all.forwarding" = 1;
+    };
+
+    systemd.network.networks = {
+      "10-wan" = {
+        matchConfig.Name = cfg.wan.interface;
+        networkConfig.DHCP = "ipv4";
+        # The router runs its own resolver; never adopt the ISP's DNS for the host.
+        dhcpV4Config.UseDNS = false;
+      };
+    } // lib.mapAttrs' (
+      name: lan:
+      lib.nameValuePair "20-lan-${name}" {
+        matchConfig.Name = lan.interface;
+        address = [ "${lan.ipv4.address}/${toString lan.ipv4.prefixLength}" ];
+        networkConfig.ConfigureWithoutCarrier = true;
+      }
+    ) cfg.lans;
+  };
+}