deploy: hardware-instance templating, wlan0 boot watchdog, deploy-time warnings in Cockpit

- deploy.conf templates interface names/USB IDs (@TOKEN@ substitution) across
  ap/* configs so a dongle swap only needs deploy.conf edited, not the repo
  configs themselves; drops ap/rtw88.conf (old 2.4GHz dongle retired for the
  DWA-171, which needs no such power-save override).
- failover/van-wlan-watchdog: recovers wlan0 from NM's post-boot no-secrets
  wedge (a boot-time supplicant race, not a real credential failure).
- deploy.sh: warn() collects dependency/config warnings (missing python3-gps,
  python3-paho-mqtt, mobile-broadband-provider-info, grpcurl, gpsd; netplan
  drift; unedited example configs) into /var/lib/vanlink/deploy-warnings.json,
  rendered as an amber Cockpit card so they're visible without reading deploy
  output.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

ap/10-van-ap.network

@@ -1,5 +1,5 @@
 [Match]
-Name=wlxc83a35a4ee55
+Name=@WIFI_5G_IFACE@
 
 [Link]
 RequiredForOnline=no

ap/11-van-ap-2g.network

@@ -1,5 +1,5 @@
 [Match]
-Name=wlxd8ec5e2faa8c
+Name=@WIFI_2G_IFACE@
 
 [Link]
 RequiredForOnline=no

ap/22-van-lan.network

@@ -2,7 +2,7 @@
 # gets DHCP/DNS from the same dnsmasq as Wi-Fi clients. NM must leave this device
 # alone (see van-ap-unmanaged.conf) for networkd to own it here.
 [Match]
-Name=enx00e04c331140
+Name=@LAN_USB_IFACE@
 
 [Link]
 RequiredForOnline=no

ap/50-van-wan.yaml

@@ -10,10 +10,11 @@ network:
   version: 2
   ethernets:
     # Starlink dish uplink (RTL8153 USB NIC, MAC-named — travels with the
-    # adapter). The /32 link route keeps the dish's management address reachable
-    # no matter which WAN holds the default route: the dish answers on
-    # 192.168.100.1 (gRPC :9200) even while the uplink sits behind CGNAT.
-    enxd8ec5eeb3512:
+    # adapter, see STARLINK_IFACE in deploy.conf). The /32 link route keeps the
+    # dish's management address reachable no matter which WAN holds the
+    # default route: the dish answers on 192.168.100.1 (gRPC :9200) even while
+    # the uplink sits behind CGNAT.
+    @STARLINK_IFACE@:
       renderer: NetworkManager
       optional: true
       dhcp4: true

ap/hostapd-2g.conf

@@ -1,4 +1,4 @@
-interface=wlxd8ec5e2faa8c
+interface=@WIFI_2G_IFACE@
 # Second, independent hostapd instance (hostapd-2g.service) — 2.4GHz band of the same
 # VanLink network, bridged into the same br0 segment as the 5GHz AP and the wired port.
 # Separate process on purpose: a USB wedge on one radio must never take down the other.
@@ -17,7 +17,7 @@ wmm_enabled=1
 # HT20 only — 40MHz in 2.4GHz overlaps most of the band and coexistence would force
 # it back to 20MHz near any neighbor anyway.
 ieee80211n=1
-ht_capab=[LDPC][SHORT-GI-20]
+ht_capab=[SHORT-GI-20]
 auth_algs=1
 wpa=2
 wpa_passphrase=1foot11foot11

ap/hostapd-2g.service

@@ -1,5 +1,5 @@
 [Unit]
-Description=VanLink 2.4GHz AP (hostapd on wlxd8ec5e2faa8c, RTL8822BU)
+Description=VanLink 2.4GHz AP (hostapd on @WIFI_2G_IFACE@ — see deploy.conf for current hardware)
 # Same USB re-enumeration hazards as the 5GHz AP (see hostapd-restart.conf for the
 # full story): never stop retrying, and back off a few seconds so the USB device can
 # re-enumerate before the next attempt.

ap/hostapd.conf

@@ -1,4 +1,4 @@
-interface=wlxc83a35a4ee55
+interface=@WIFI_5G_IFACE@
 # Put the AP into br0 so Wi-Fi and the wired LAN port share one 10.42.0.0/24 segment.
 # hostapd adds the wlan to the bridge after setting AP mode; the bridge itself + its
 # wired member + the gateway IP are defined under /etc/systemd/network (2x-van-br0/lan).

ap/rtw88.conf

@@ -1,10 +0,0 @@
-# 2.4GHz AP dongle (Linksys WUSB6300 v2, RTL8822BU, rtw88_8822bu).
-# Deep power-save has no business on an always-on AP radio — same reasoning as the
-# rtw89 disable_ps_mode gotcha on the 5GHz dongle (rtw89.conf).
-options rtw88_core disable_lps_deep=Y
-# Don't let the driver switch a USB2-enumerated dongle up to USB3: USB3 signalling
-# radiates broadband noise right across the 2.4GHz band, and HT20 rates fit in USB2
-# easily. NOTE: this only blocks the driver's own USB2->3 switch — a dongle sitting in
-# a USB3 port still enumerates at SuperSpeed (it currently does); move it to a USB2
-# port if 2.4GHz range/interference ever looks poor.
-options rtw88_usb switch_usb_mode=N

ap/van-ap-unmanaged.conf

@@ -2,4 +2,4 @@
 # The AP wlans (5GHz + 2.4GHz) and the wired LAN ports (USB dongle + onboard
 # eth0) are all owned by systemd-networkd/hostapd (bridged into br0), so
 # NetworkManager must not touch them.
-unmanaged-devices=interface-name:wlxc83a35a4ee55;interface-name:wlxd8ec5e2faa8c;interface-name:enx00e04c331140;interface-name:eth0
+unmanaged-devices=interface-name:@WIFI_5G_IFACE@;interface-name:@WIFI_2G_IFACE@;interface-name:@LAN_USB_IFACE@;interface-name:eth0