router: optional Wi-Fi access point, enforce allowWan

wifi.* settings turn the gateway's own radios into the site AP (hostapd):
SSIDs are defined once in wifi.networks and act as untagged access ports of
their VLAN (each BSS joins br0 with the VLAN's PVID), radios pick what they
broadcast, passphrases are vars prompts. Extra SSIDs on a radio get BSSIDs
derived from its hardware address. A udev rule puts configured radios in AP
mode on appearance, since networkd cannot bridge a station-mode interface
and gives up before hostapd switches it. wifi.enable gates all of it.

The VM test grows a hwsim radio with two SSIDs and a WPA3 station in its
own netns that must get a Kea lease on the SSID's VLAN. Making the client
deterministic (route metrics, loose rp-filter, a guard against a vacuous
negative check) exposed that allowWan was never enforced: networking.nat
opens forward-to-WAN for all of its internalInterfaces, which listed every
VLAN. It now lists only the allowWan VLANs; the duplicate custom rule is
gone. No behavioural change on gw-cnx-1 (all its VLANs allow WAN).

docs/src/gateways.md

@@ -12,10 +12,11 @@ Naming: `gw-<city>-<n>`, e.g. `gw-cnx-1`.
 
 The service has a NixOS VM test (`modules/clan/router/tests/vm/`): an ISP
 node runs a PPPoE access concentrator, a `client` sits on the tagged lan/iot
-VLANs behind the trunk, an `admin` on the untagged mgmt access port. It checks
-the PPPoE dial-in, leases/reservations, Blocky, NAT, `allowWan`, the mgmt-only
-trust model and SSH exposure. Run it with `nix build .#checks.x86_64-linux.router`
-(also part of `nix flake check`).
+VLANs behind the trunk, an `admin` on the untagged mgmt access port, and a
+simulated radio (`mac80211_hwsim`) carries two SSIDs with a WPA3 station. It
+checks the PPPoE dial-in, leases/reservations, Blocky, NAT, `allowWan`, the
+mgmt-only trust model, SSH exposure and the Wi-Fi bridge ports. Run it with
+`nix build .#checks.x86_64-linux.router` (also part of `nix flake check`).
 
 ## What each gateway runs
 
@@ -29,6 +30,7 @@ trust model and SSH exposure. Run it with `nix build .#checks.x86_64-linux.route
 | IPv6         | DHCPv6-PD on ppp0, /64 per VLAN via SLAAC                                                                                                                                                     |
 | Bans         | CrowdSec + nftables bouncer (sshd log parsing)                                                                                                                                                |
 | Omada        | Optional per site: TP-Link Omada controller as a podman container                                                                                                                             |
+| Wi-Fi        | Optional: hostapd on the router's radios; each SSID (`wifi.networks`) is an untagged access port of its VLAN, passphrases via vars prompts — see `modules/clan/router/README.md`              |
 | Proxy        | Optional: Caddy reverse proxy for internal services under `*.<site><n>.cnx.network` with a real Let's Encrypt wildcard (DNS-01 against ns1)                                                   |
 | Diagnostics  | iperf3 server on 5201, reachable from every VLAN and the mesh (`iperf3 -c <router-vlan-addr>`); CLI toolkit: tcpdump, mtr, ethtool, conntrack, kdig, iftop, librespeed-cli                    |
 | Speed test   | Hourly librespeed run (`speedtest.timer`) → `speedtest_*` metrics via node_exporter; vmalert flags download < 50% of the link's own 7-day median (`WANSpeedDegraded`)                         |