Add the Packages page for nixpkgs upgrades

A page under System for router-upgrade: the channel to follow, Check,
Preview (the package versions that change, the download size, what would be
built here, a reboot note for a new kernel), Download now and Upgrade. The
steps run in router-upgrade.service, which the page asks through a request
file; the last run's output is kept in upgrade/last.log because a finished
one-shot unit has no journal to look up.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

tests/apply.nix

@@ -416,5 +416,33 @@ pkgs.testers.runNixOSTest {
         target.succeed("test ! -e /var/lib/router/config.pre-update")
         target.succeed("cp /tmp/settings.good /var/lib/router/config/settings.json")
         assert current() == upgraded
+
+    with subtest("the packages page drives the same steps"):
+        channel(running_rev)
+
+        def unit_done(unit):
+            target.wait_until_succeeds(f"test $(systemctl show -p ActiveState --value {unit}) = inactive"
+                                       f" && test $(systemctl show -p Result --value {unit}) = success", timeout=300)
+
+        def step(name, extra=""):
+            code = curl(f"-o /dev/null -w '%{{http_code}}' -d csrf={csrf('/upgrade')} {extra} {ui}/upgrade/{name}")
+            assert code == "303", (name, code)
+            unit_done("router-upgrade.service")
+
+        page = curl(f"{ui}/upgrade")
+        assert "Packages" in page and 'value="26.05" selected' in page and target.succeed("cat /run/current-system/nixos-version").strip() in page, page
+        assert curl(f"-o /dev/null -w '%{{http_code}}' -d csrf={csrf('/upgrade')} -d 'channel=nixos-26.05%3Bx' {ui}/upgrade/channel") == "303"
+        assert "26.05" in target.succeed("jq -r .router.update.channel /var/lib/router/config/settings.json")
+        assert curl(f"-o /dev/null -w '%{{http_code}}' -d csrf=wrong {ui}/upgrade/check") == "403"
+        step("check")
+        assert "Up to date." in curl(f"{ui}/upgrade")
+        step("preview", "-d force=on")
+        page = curl(f"{ui}/upgrade")
+        assert "No package changes" in page and "Upgrade to" in page, page
+        step("download")
+        step("apply")
+        assert "Upgrade to" not in curl(f"{ui}/upgrade")
+        assert json.loads(target.succeed("cat /var/lib/router/config/nixpkgs-pin.json"))["rev"] == running_rev
+        assert "Last run" in curl(f"{ui}/upgrade")
   '';
 }