Add site gateway role (modules/router) and gw-cnx-1

Reusable cnx.router.* module for the Topton 1U boxes replacing OPNsense:
PPPoE WAN (optionally VLAN-tagged, AIS: 10, secret credentials incl.
username), VLAN-filtering bridge, nftables NAT/firewall with MSS clamp,
Kea DHCP with per-VLAN lease time, Blocky DNS, DHCPv6-PD, CrowdSec with
the ZeroTier mesh whitelisted, optional Omada controller, ZFS disk.

Fleet baseline rides along: admins sops group is now derived for every
machine in clan.nix (secrets encrypt to it from the first vars generate)
and time sync is chrony everywhere instead of systemd-timesyncd.

machines/ns1/configuration.nix

@@ -18,8 +18,6 @@ in
     ../../modules/monitoring/exporters.nix
   ];
 
-  clan.core.sops.defaultGroups = [ "admins" ];
-
   # Knot's state dir holds the non-regenerable DNSSEC key material (KSK/ZSK
   # private keys in the KASP keystore). Declaring it as clan state makes the
   # borgbackup client back it up; losing it forces an emergency DS rollover at
@@ -38,7 +36,7 @@ in
   };
 
   time.timeZone = "Etc/GMT-1"; # UTC+1 (fixed offset, no DST)
-  services.timesyncd.enable = true;
+  services.chrony.enable = true;
 
   # ACME DNS-01 (RFC 2136), general key. A dedicated TSIG key scoped by acl_acme
   # (referenced by every zone below) to TXT updates at or under _acme-challenge.