Add site gateway role (modules/router) and gw-cnx-1

Reusable cnx.router.* module for the Topton 1U boxes replacing OPNsense:
PPPoE WAN (optionally VLAN-tagged, AIS: 10, secret credentials incl.
username), VLAN-filtering bridge, nftables NAT/firewall with MSS clamp,
Kea DHCP with per-VLAN lease time, Blocky DNS, DHCPv6-PD, CrowdSec with
the ZeroTier mesh whitelisted, optional Omada controller, ZFS disk.

Fleet baseline rides along: admins sops group is now derived for every
machine in clan.nix (secrets encrypt to it from the first vars generate)
and time sync is chrony everywhere instead of systemd-timesyncd.

docs/src/SUMMARY.md

@@ -3,5 +3,7 @@
 - [Overview](./overview.md)
 - [ZeroTier mesh](./mesh.md)
 - [DNS](./dns.md)
+- [Mail](./mail.md)
+- [Site gateways](./gateways.md)
 - [Monitoring](./monitoring.md)
 - [Backups](./backups.md)