inventory.nix: router instance for gw-cnx-1

Move the `router` service instance out of clan.nix into its own clan
module, inventory.nix, imported by clan.nix. Fleet-wide role settings
(mesh subnet, proxy domain/ACME) and the gw-cnx-1 site layout live there;
clan.nix keeps the machine list and the clan-core services. The gw-cnx-1
toplevel is byte-identical before and after the move.

docs/src/gateways.md

@@ -5,8 +5,8 @@ NixOS routers (OPNsense replacements) on Topton 1U fanless boxes — Intel N300,
 Four sites are planned; the first is `gw-cnx-1` (Chiang Mai). Everything lives
 in the `router` clan service (`modules/clan/router/`, registered as
 `modules.router` in `clan.nix`); a site joins by adding its machine to the
-`router` inventory instance with settings for port names, VLANs, and feature
-flags (`inventory.instances.router.roles.default.machines.<gw>.settings`).
+`router` inventory instance in `inventory.nix` with settings for port names,
+VLANs, and feature flags (`roles.default.machines.<gw>.settings`).
 
 Naming: `gw-<city>-<n>`, e.g. `gw-cnx-1`.
 
@@ -70,7 +70,7 @@ Trust model: mgmt → everything; other VLANs → router DNS/DHCP + internet onl
    hostId, timezone). Fill the real disk id in `disko.nix` (from the
    installer: `ls -l /dev/disk/by-id/`).
 2. Add the machine to `inventory.machines` in `clan.nix`, to the `router`
-   instance (`roles.default.machines.gw-<city>-<n>.settings`: `site`,
+   instance in `inventory.nix` (`roles.default.machines.gw-<city>-<n>.settings`: `site`,
    `siteId` (next free number), port names, VLANs, `omada.enable`; keep the
    `mgmt`/`lan` VLANs), and to the machine list in `modules/mesh-hosts.nix`.
    Do **not** add it to `modules/hosts.nix` (dynamic PPPoE IP; clan connects
@@ -129,7 +129,7 @@ proxy = {
   PPPoE with zero inbound reachability, and browsers trust it without a CA
   install. Each gateway has its own TSIG key (`acme_gw_<city>_<n>`) that ns1
   scopes to `_acme-challenge.<site><n>` TXT records only. The zone, ns1's
-  address and the ACME contact are fleet-wide role settings in `clan.nix`
+  address and the ACME contact are fleet-wide role settings in `inventory.nix`
   (`proxy.domain`, `proxy.acme.nameserver`, `proxy.acme.email`).
 - **Resolution**: the names exist only internally — Blocky answers
   `*.<site><n>.cnx.network` with the router's `lan` address; the public