Add site gateway role (modules/router) and gw-cnx-1

Reusable cnx.router.* module for the Topton 1U boxes replacing OPNsense:
PPPoE WAN (optionally VLAN-tagged, AIS: 10, secret credentials incl.
username), VLAN-filtering bridge, nftables NAT/firewall with MSS clamp,
Kea DHCP with per-VLAN lease time, Blocky DNS, DHCPv6-PD, CrowdSec with
the ZeroTier mesh whitelisted, optional Omada controller, ZFS disk.

Fleet baseline rides along: admins sops group is now derived for every
machine in clan.nix (secrets encrypt to it from the first vars generate)
and time sync is chrony everywhere instead of systemd-timesyncd.

machines/gw-cnx-1/configuration.nix

@@ -0,0 +1,41 @@
+# Site gateway Chiang Mai (site 1): Topton 1U, Intel N300, 4x i226-V 2.5G.
+# Port roles below use the expected igc names — verify against facter.json
+# after the first install and adjust if the box enumerates differently.
+{ config, lib, ... }:
+{
+  imports = [
+    ../../modules/router
+    ../../modules/monitoring/exporters.nix
+  ];
+
+  # Until the install generates facter.json (which normally provides this).
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+
+  # ZFS (disko.nix) needs a stable machine-unique hostId; derive it from the
+  # hostname so every gateway gets one for free when copied for a new site.
+  networking.hostId = builtins.substring 0 8 (
+    builtins.hashString "sha256" config.networking.hostName
+  );
+
+  cnx.router = {
+    enable = true;
+    site = "cnx";
+    siteId = 1;
+    wan.interface = "enp1s0";
+    wan.vlanId = 10; # AIS delivers PPPoE tagged on VLAN 10
+    trunkPorts = [
+      "enp2s0"
+      "enp3s0"
+      "enp4s0"
+    ];
+    vlans = {
+      mgmt.id = 10; # 10.1.10.0/24 — APs, switches, Omada, admin
+      lan.id = 20; # 10.1.20.0/24 — trusted clients
+    };
+    # This site runs the Omada controller for its APs/switches.
+    omada.enable = true;
+  };
+
+  time.timeZone = "Etc/GMT-7"; # UTC+7 (Thailand, fixed offset, no DST)
+  services.chrony.enable = true;
+}