Add site gateway role (modules/router) and gw-cnx-1

Reusable cnx.router.* module for the Topton 1U boxes replacing OPNsense:
PPPoE WAN (optionally VLAN-tagged, AIS: 10, secret credentials incl.
username), VLAN-filtering bridge, nftables NAT/firewall with MSS clamp,
Kea DHCP with per-VLAN lease time, Blocky DNS, DHCPv6-PD, CrowdSec with
the ZeroTier mesh whitelisted, optional Omada controller, ZFS disk.

Fleet baseline rides along: admins sops group is now derived for every
machine in clan.nix (secrets encrypt to it from the first vars generate)
and time sync is chrony everywhere instead of systemd-timesyncd.

machines/web01/configuration.nix

@@ -9,8 +9,6 @@ in
     ../../modules/web-proxy.nix
   ];
 
-  clan.core.sops.defaultGroups = [ "admins" ];
-
   # Public IPv6 (from modules/hosts.nix); SLAAC doesn't bring it up here.
   cnx.staticIPv6 = {
     enable = true;
@@ -18,5 +16,5 @@ in
   };
 
   time.timeZone = "Etc/GMT-8"; # UTC+8 (Singapore, fixed offset, no DST)
-  services.timesyncd.enable = true;
+  services.chrony.enable = true;
 }