feat(router): route server management (BGP + tunnels)

[v0l]

Closes #138

Extends the router subsystem with BGP and tunnel management behind two new optional capability traits (TunnelRouter, BgpRouter) on the existing Router abstraction, implemented by a new Linux/SSH backend and Mikrotik.

What's included

• Linux/SSH router (RouterKind::LinuxSsh) — url = ssh://user@host[:port]/iface, token = PEM key; ARP via iproute2; reuses the existing ssh2 SshClient (behind a linux-ssh feature).
• TunnelRouter — GRE/VXLAN/WireGuard detect + manage with per-interface traffic counters. Linux (ip/wg) and Mikrotik (/rest/interface/*).
• BgpRouter — session detection, scoped originated-route + default-route detection, peer discovery, enable/disable toggle. Linux (birdc, BIRD/Pathvector) and Mikrotik (/rest/routing/bgp/*).
• Persistence — router_tunnel, router_tunnel_traffic, router_bgp_session tables + a 60s background sampler (WorkJob::SampleRouterTraffic).
• Admin API — list tunnels, per-tunnel traffic history (from/to), list BGP sessions, toggle BGP session (WorkJob::ToggleBgpSession).

Issue tasks

Task	Status
1. Simple Linux VM (SSH) routers	✅
2. Detect BGP sessions	✅
3. Detect originated routes for VM ranges	✅ (scoped to candidates)
4. Detect default route	✅
5. Discover peers, up/downstream	✅ (BIRD RFC-9234 role)
6. Toggle BGP sessions	✅
7. Per-session traffic	✅ (tunnel interface counters — BGP has none)

Full DFZ table safety

Routers may carry a full internet table (~1M+ routes). Handled:

• Mikrotik never does unfiltered GET /rest/ip/route; uses server-side dst-address filters.
• originated_routes(candidates) is scoped to VM prefixes, never enumerates the table.
• BIRD uses show route for <addr> (LPM) + show route where source = RTS_STATIC (bounded output) — never a bare show route.
• The 60s sampler only reads tunnel/session listings (bounded), never routes.

Notes / follow-ups

• WireGuard private keys are written to a 0600 temp file on the router during wg set and never returned on listing; DB storage of key material is an open question.
• Pathvector toggling uses runtime birdc disable/enable; persisting via Pathvector YAML regeneration is a follow-up.
• Tunnel CRUD via admin and originated/default-route admin endpoints are deferred (capabilities exist in the traits).

Testing

• 343 unit tests pass (cargo test --workspace --exclude lnvps_e2e -- --test-threads=1); cargo fmt + cargo clippy clean.
• New tests: BIRD protocol/route parsers, WG dump/set parsing, Mikrotik helpers, DB CRUD, worker sampler + toggle integration, admin model conversions.

Implementation tracked in work/route-server-management.md.