stellio: NAT LAN/Wi-Fi out the staging uplink; cross-safe Blocky check

cnx-network 4146f2c -> 596ac1f: allowWan VLANs are now forwarded and
masqueraded through stagingPort (lan5) while ppp0 is down, and pppd gets
`defaultroute-metric 0` so the PPPoE route is installed next to the
staging DHCP route instead of being refused. Also makes CrowdSec opt-in
upstream (stellio leaves it off).

The nixpkgs Blocky config check runs the aarch64 binary, which an x86_64
builder without binfmt cannot execute (`--max-jobs 0`); validate the same
YAML with the build host's blocky until the router service carries this.

flake.lock

@@ -181,11 +181,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1789726083,
+        "lastModified": 1789975217,
-        "narHash": "sha256-oxlp99L8KXYDdzroS+QeqhQyFigVHp44D6aVFsifpe0=",
+        "narHash": "sha256-n7L5vHbyemIa5jzlueIdpWmQsQSkv5Rrf9JV5kTZ6uU=",
         "ref": "clanService-router-ai",
-        "rev": "4146f2c878b104d96d25575be553378ae276f6e0",
+        "rev": "596ac1f4bb851af3e03c06ba286cb33ae36095d2",
-        "revCount": 198,
+        "revCount": 201,
         "type": "git",
         "url": "https://git.b4l.co.th/B4L/cnx-network-clan"
       },

machines/stellio/configuration.nix

@@ -1,4 +1,10 @@
-{ inputs, lib, ... }:
+{
+  config,
+  inputs,
+  lib,
+  pkgs,
+  ...
+}:
 {
   imports = [
     inputs.matthew-hardware.nixosModules.mt7986a-glinet-gl-mt6000
@@ -27,5 +33,20 @@
 
     clan.core.settings.name = "stellio";
     clan.core.settings.machine.description = "Flint-2 router";
+
+    # nixpkgs' services.blocky check runs the aarch64 blocky in a
+    # system.checks derivation, which an x86_64 builder without binfmt cannot
+    # execute (`--max-jobs 0` -> Exec format error). Validate the same YAML
+    # with the build host's blocky instead. Drop once cnx-network's router
+    # service carries this itself (router/dns: validate the Blocky config
+    # with the build host's binary).
+    services.blocky.enableConfigCheck = false;
+    system.checks = [
+      (pkgs.runCommand "check-blocky-config" { } ''
+        ${lib.getExe pkgs.buildPackages.blocky} --config ${
+          (pkgs.formats.yaml { }).generate "blocky-config.yaml" config.services.blocky.settings
+        } validate && touch $out
+      '')
+    ];
   };
 }