Add the Packages page for nixpkgs upgrades

A page under System for router-upgrade: the channel to follow, Check,
Preview (the package versions that change, the download size, what would be
built here, a reboot note for a new kernel), Download now and Upgrade. The
steps run in router-upgrade.service, which the page asks through a request
file; the last run's output is kept in upgrade/last.log because a finished
one-shot unit has no journal to look up.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

pkgs/router-webui/templates/layout.html

@@ -29,6 +29,7 @@
     </div>
     <div class="group"><span>System</span>
       <a href="/update"{{if eq .Title "Update"}} aria-current="page"{{end}}>Update</a>
+      <a href="/upgrade"{{if eq .Title "Packages"}} aria-current="page"{{end}}>Packages</a>
       <a href="/tokens"{{if eq .Title "API access"}} aria-current="page"{{end}}>API access</a>
       <a href="/advanced"{{if eq .Title "Advanced"}} aria-current="page"{{end}}>Advanced</a>
     </div>

pkgs/router-webui/templates/upgrade.html

@@ -0,0 +1,99 @@
+{{define "content"}}
+<div class="cols">
+{{$d := .Data}}
+<section>
+  <h2>Packages</h2>
+  <p>Upgrades the kernel and all programs (NixOS) without a new release of nixos-router. Nothing is downloaded until
+     you ask for it, and an upgrade is activated like a settings change: unless you confirm it in time, the router
+     goes back to the previous system.</p>
+  <dl>
+    <dt>Running</dt><dd>{{or $d.Version "unknown"}}</dd>
+  </dl>
+  <form method="post" action="/upgrade/channel" class="actions">
+    <input type="hidden" name="csrf" value="{{.CSRF}}">
+    <label>Follow
+      <select name="channel">
+        {{range $d.Choices}}<option value="{{.Value}}"{{if eq .Value $d.Channel}} selected{{end}}>{{.Label}}</option>{{end}}
+      </select>
+    </label>
+    <button class="secondary">Save</button>
+  </form>
+  <p class="hint">The channel only chooses what an upgrade offers; saving it changes nothing on the router. NixOS cannot go back to
+     an older release.</p>
+</section>
+
+{{if $d.Updating}}
+<section class="busy"><h2>Updating…</h2><p>The router is installing a new version of nixos-router.</p></section>
+{{else if $d.Run.Running}}
+<section class="busy"><h2>Working…</h2><p>This page refreshes on its own. The web UI restarts when an upgrade is switched on.</p></section>
+{{else if $d.Pending}}
+<section class="pending"><h2>Waiting for confirmation</h2>
+  <p>A new system is active and not confirmed yet. Confirm it on the <a href="/">Overview</a>, or the router goes back to the
+     previous one.</p></section>
+{{end}}
+
+{{if $d.Channel}}
+<section>
+  <h2>Check</h2>
+  <form method="post" action="/upgrade/check" class="actions">
+    <input type="hidden" name="csrf" value="{{.CSRF}}">
+    <button class="secondary"{{if or $d.Run.Running $d.Updating}} disabled{{end}}>Check for upgrades</button>
+  </form>
+  {{with $d.Check}}
+    <dl>
+      <dt>Channel</dt><dd>{{.Branch}}</dd>
+      <dt>Running</dt><dd>{{.Running.Version}}</dd>
+      <dt>Newest</dt><dd>{{printf "%.7s" .Newest.Rev}} <span class="muted">checked {{.Time}}</span></dd>
+    </dl>
+    {{if .UpToDate}}<p>Up to date.</p>{{else}}<p>A newer revision is available.</p>{{end}}
+  {{end}}
+</section>
+
+<section>
+  <h2>What would change</h2>
+  <form method="post" action="/upgrade/preview" class="actions">
+    <input type="hidden" name="csrf" value="{{.CSRF}}">
+    {{if and $d.Check $d.Check.UpToDate}}<label><input type="checkbox" name="force"> look anyway</label>{{end}}
+    <button class="secondary"{{if or $d.Run.Running $d.Updating}} disabled{{end}}>Preview</button>
+  </form>
+  <p class="hint">Works it out from the new revision's description: no package is downloaded.</p>
+  {{with $d.Preview}}
+    <p><strong>{{.Version}}</strong> <span class="muted">{{printf "%.7s" .Rev}}, previewed {{.Time}}</span></p>
+    {{if .Changes}}
+    <table>
+      <thead><tr><th>Package</th><th>Now</th><th></th><th>New</th></tr></thead>
+      <tbody>{{range .Changes}}<tr><td>{{.Name}}</td><td>{{.From}}</td><td>→</td><td>{{.To}}</td></tr>{{end}}</tbody>
+    </table>
+    {{else}}<p>No package changes.</p>{{end}}
+    <p class="hint">The list shows the versions of programs the router runs; a program that is only rebuilt does not appear.</p>
+    <dl>
+      <dt>To download</dt><dd>{{or .Download "nothing, or the package cache cannot be reached"}}</dd>
+      <dt>Built here</dt><dd>{{.Builds}} derivation{{if ne .Builds 1}}s{{end}}{{if gt .Builds 50}} <span class="muted">(many: the package cache may not have them yet; this takes long)</span>{{end}}</dd>
+      {{if .RebootNeeded}}<dt>Kernel</dt><dd>A new kernel: it runs after the next reboot.</dd>{{end}}
+    </dl>
+    <div class="actions">
+      <form method="post" action="/upgrade/download">
+        <input type="hidden" name="csrf" value="{{$.CSRF}}">
+        <button class="secondary"{{if or $d.Run.Running $d.Updating $d.Pending}} disabled{{end}}>Download now</button>
+      </form>
+      <form method="post" action="/upgrade/apply">
+        <input type="hidden" name="csrf" value="{{$.CSRF}}">
+        <button{{if or $d.Run.Running $d.Updating $d.Pending}} disabled{{end}}>Upgrade to {{.Version}}</button>
+      </form>
+    </div>
+    <p class="hint">Downloading first lets you start the upgrade later without needing the internet. Upgrading
+       downloads what is missing, builds the system and switches to it; confirm it on the Overview.</p>
+  {{end}}
+</section>
+{{else}}
+<section><p>Choose a channel to look for upgrades.</p></section>
+{{end}}
+
+{{if $d.Run.Log}}
+<section>
+  <h2>Last run{{if $d.Run.Result}} — {{if eq $d.Run.Result "success"}}succeeded{{else}}failed ({{$d.Run.Result}}){{end}}{{end}}</h2>
+  <pre class="log">{{$d.Run.Log}}</pre>
+</section>
+{{end}}
+</div>
+{{end}}