deploy: hardware-instance templating, wlan0 boot watchdog, deploy-time warnings in Cockpit

- deploy.conf templates interface names/USB IDs (@TOKEN@ substitution) across
  ap/* configs so a dongle swap only needs deploy.conf edited, not the repo
  configs themselves; drops ap/rtw88.conf (old 2.4GHz dongle retired for the
  DWA-171, which needs no such power-save override).
- failover/van-wlan-watchdog: recovers wlan0 from NM's post-boot no-secrets
  wedge (a boot-time supplicant race, not a real credential failure).
- deploy.sh: warn() collects dependency/config warnings (missing python3-gps,
  python3-paho-mqtt, mobile-broadband-provider-info, grpcurl, gpsd; netplan
  drift; unedited example configs) into /var/lib/vanlink/deploy-warnings.json,
  rendered as an amber Cockpit card so they're visible without reading deploy
  output.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

ap/hostapd-2g.conf

@@ -1,4 +1,4 @@
-interface=wlxd8ec5e2faa8c
+interface=@WIFI_2G_IFACE@
 # Second, independent hostapd instance (hostapd-2g.service) — 2.4GHz band of the same
 # VanLink network, bridged into the same br0 segment as the 5GHz AP and the wired port.
 # Separate process on purpose: a USB wedge on one radio must never take down the other.
@@ -17,7 +17,7 @@ wmm_enabled=1
 # HT20 only — 40MHz in 2.4GHz overlaps most of the band and coexistence would force
 # it back to 20MHz near any neighbor anyway.
 ieee80211n=1
-ht_capab=[LDPC][SHORT-GI-20]
+ht_capab=[SHORT-GI-20]
 auth_algs=1
 wpa=2
 wpa_passphrase=1foot11foot11