deploy: hardware-instance templating, wlan0 boot watchdog, deploy-time warnings in Cockpit

- deploy.conf templates interface names/USB IDs (@TOKEN@ substitution) across
  ap/* configs so a dongle swap only needs deploy.conf edited, not the repo
  configs themselves; drops ap/rtw88.conf (old 2.4GHz dongle retired for the
  DWA-171, which needs no such power-save override).
- failover/van-wlan-watchdog: recovers wlan0 from NM's post-boot no-secrets
  wedge (a boot-time supplicant race, not a real credential failure).
- deploy.sh: warn() collects dependency/config warnings (missing python3-gps,
  python3-paho-mqtt, mobile-broadband-provider-info, grpcurl, gpsd; netplan
  drift; unedited example configs) into /var/lib/vanlink/deploy-warnings.json,
  rendered as an amber Cockpit card so they're visible without reading deploy
  output.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

ap/50-van-wan.yaml

@@ -10,10 +10,11 @@ network:
   version: 2
   ethernets:
     # Starlink dish uplink (RTL8153 USB NIC, MAC-named — travels with the
-    # adapter). The /32 link route keeps the dish's management address reachable
-    # no matter which WAN holds the default route: the dish answers on
-    # 192.168.100.1 (gRPC :9200) even while the uplink sits behind CGNAT.
-    enxd8ec5eeb3512:
+    # adapter, see STARLINK_IFACE in deploy.conf). The /32 link route keeps the
+    # dish's management address reachable no matter which WAN holds the
+    # default route: the dish answers on 192.168.100.1 (gRPC :9200) even while
+    # the uplink sits behind CGNAT.
+    @STARLINK_IFACE@:
       renderer: NetworkManager
       optional: true
       dhcp4: true