Add a generic installer that asks for the basics and builds offline

The installer ISO no longer needs a prebuilt system: `router-setup` asks
for the disk, the WAN and LAN interfaces, DHCP or PPPoE (optionally on a
VLAN), host name, LAN address and a password, writes settings.json and
the secrets, builds that router offline (the ISO carries a reference
router system whose closure has everything the build needs) and installs
it with `router-install --system`.

The password is used for the web UI and, hashed, as root's console
password (routerSettings sets root's hashedPasswordFile; it applies when
the account is created at installation).

checks.setup answers router-setup on the console and checks the installed
box: its settings, the web UI and console login with that password, and
a rebuild that reproduces the installed system.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AeFqV9dZrK6nipHkPfyM4F

modules/settings/default.nix

@@ -109,6 +109,10 @@ in
     networking.hostName = system.hostName or "router";
     time.timeZone = system.timeZone or "UTC";
     users.users.root.openssh.authorizedKeys.keys = system.sshKeys or [ ];
+    # Written by router-setup (the web UI password). Users are mutable, so it
+    # only sets the password when the account is created, at installation;
+    # `passwd` changes it later.
+    users.users.root.hashedPasswordFile = lib.mkDefault "${cfg.stateDirectory}/root-password";
     system.stateVersion = system.stateVersion or config.system.nixos.release;
 
     nix.settings.experimental-features = [