stellio: NAT LAN/Wi-Fi out the staging uplink; cross-safe Blocky check

cnx-network 4146f2c -> 596ac1f: allowWan VLANs are now forwarded and
masqueraded through stagingPort (lan5) while ppp0 is down, and pppd gets
`defaultroute-metric 0` so the PPPoE route is installed next to the
staging DHCP route instead of being refused. Also makes CrowdSec opt-in
upstream (stellio leaves it off).

The nixpkgs Blocky config check runs the aarch64 binary, which an x86_64
builder without binfmt cannot execute (`--max-jobs 0`); validate the same
YAML with the build host's blocky until the router service carries this.

machines/stellio/configuration.nix

@@ -1,4 +1,10 @@
-{ inputs, lib, ... }:
+{
+  config,
+  inputs,
+  lib,
+  pkgs,
+  ...
+}:
 {
   imports = [
     inputs.matthew-hardware.nixosModules.mt7986a-glinet-gl-mt6000
@@ -27,5 +33,20 @@
 
     clan.core.settings.name = "stellio";
     clan.core.settings.machine.description = "Flint-2 router";
+
+    # nixpkgs' services.blocky check runs the aarch64 blocky in a
+    # system.checks derivation, which an x86_64 builder without binfmt cannot
+    # execute (`--max-jobs 0` -> Exec format error). Validate the same YAML
+    # with the build host's blocky instead. Drop once cnx-network's router
+    # service carries this itself (router/dns: validate the Blocky config
+    # with the build host's binary).
+    services.blocky.enableConfigCheck = false;
+    system.checks = [
+      (pkgs.runCommand "check-blocky-config" { } ''
+        ${lib.getExe pkgs.buildPackages.blocky} --config ${
+          (pkgs.formats.yaml { }).generate "blocky-config.yaml" config.services.blocky.settings
+        } validate && touch $out
+      '')
+    ];
   };
 }