Add gateway diagnostics: iperf3, CLI toolkit, periodic WAN speed test

iperf3 serves throughput tests from every VLAN and the mesh; an hourly
librespeed run feeds speedtest_* metrics through node_exporter's textfile
collector, and vmalert flags download rates below half the link's own
7-day median so ISP degradation surfaces without per-site thresholds.

modules/router/default.nix

@@ -11,6 +11,7 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }:
 let
@@ -85,6 +86,8 @@ in
     ./crowdsec.nix
     ./omada.nix
     ./proxy.nix
+    ./iperf.nix
+    ./speedtest.nix
   ];
 
   options.cnx.router = {
@@ -152,6 +155,19 @@ in
       }
     ];
 
+    # Router diagnostics toolkit: packets (tcpdump), path (mtr), link
+    # negotiation (ethtool), NAT state (conntrack), DNS (kdig), per-flow
+    # bandwidth (iftop), WAN throughput (librespeed-cli; iperf3 covers LAN).
+    environment.systemPackages = with pkgs; [
+      tcpdump
+      mtr
+      ethtool
+      conntrack-tools
+      knot-dns
+      iftop
+      librespeed-cli
+    ];
+
     networking.useNetworkd = true;
     networking.useDHCP = false;
     systemd.network.enable = true;