Template NM WAN pieces: netplan split, cellular keyfile, new host variables

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KqhjP7nud5gdBg25zCiRk9

ap/50-van-wan.yaml

@@ -33,26 +33,3 @@ network:
       networkmanager:
         passthrough:
           ipv4.never-default: "true"
-  wifis:
-    @WIFI_WAN_IFACE@:
-      renderer: NetworkManager
-      optional: true
-      dhcp4: true
-      # IPv6 is deliberate as of 2026-07-12: NM does SLAAC/DHCPv6 itself.
-      # Before this it only worked by accident — dracut's runtime catch-all
-      # /run/systemd/network/zzzz-dracut-default.network had networkd
-      # co-managing wlan0 (second DHCPv4 client + surprise IPv6); deploy.sh
-      # now masks that file. Privacy (temporary) addresses stay off so hbd
-      # and DNS see one stable source address per uplink.
-      dhcp6: true
-      ipv6-privacy: false
-      # never-default: see the Starlink stanza above — same reasoning, applies to every
-      # van-failover-managed WAN.
-      networkmanager:
-        passthrough:
-          ipv4.never-default: "true"
-      access-points:
-        "Wapana":
-          auth:
-            key-management: "psk"
-            password: "6e1335fd97165a7d2618bec19824be363a2766d7765f91aa14773d871eaa59dc"