failover: ipv4.never-default + per-WAN probe scheduling; tune probe cadence

van-failover is now the sole owner of default-route selection: netplan/NM
profiles get ipv4.never-default so NM's own DHCP/lease renewals stop
reinstalling competing default routes (was racing van-failover's enforce_route
on Starlink's 16s lease). set_profile_metric() also pins never-default on
NM-managed connections it doesn't own the netplan source for (e.g. cellular),
and nm_gateway() falls back to the raw DHCP4 lease's `routers` option since NM
stops populating IP4.GATEWAY once never-default is set.

Probing moved from one shared round to independent per-WAN retry scheduling,
so a flaky WAN retries on its own clock instead of dragging healthy WANs into
extra probes or throttling a failing one to the slow steady-state cadence.

config.json: probe_interval 4->60, fail/ok_threshold 3/2->2/1, single probe
URL — verified live across this reboot (cellular took ~2min after NM reported
"activated" to actually pass traffic; van-failover correctly withheld/
deprioritized the default route until then, then installed it automatically).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

ap/50-van-wan.yaml

@@ -21,6 +21,18 @@ network:
       routes:
         - to: 192.168.100.1/32
           scope: link
+      # never-default: van-failover is the sole owner of the default route (it manages it
+      # directly via `ip route`, deliberately never `nmcli device reapply`d — that resets
+      # r8152 USB-ethernet carriers). Without this, NM's own DHCP client reinstalls its own
+      # default route (metric 100, NM's ethernet default) on every lease renewal — observed
+      # every ~8s here (dish hands out a 16s lease) — which van-failover's loop prunes within
+      # ~1s, but during that window it can tie wifi's own healthy base metric (also 100).
+      # Setting this at connection-creation time (vs. a live `nmcli modify`, which does NOT
+      # take effect on an already-active connection without a reactivation) closes the race
+      # for good.
+      networkmanager:
+        passthrough:
+          ipv4.never-default: "true"
   wifis:
     wlan0:
       renderer: NetworkManager
@@ -34,6 +46,11 @@ network:
       # and DNS see one stable source address per uplink.
       dhcp6: true
       ipv6-privacy: false
+      # never-default: see the Starlink stanza above — same reasoning, applies to every
+      # van-failover-managed WAN.
+      networkmanager:
+        passthrough:
+          ipv4.never-default: "true"
       access-points:
         "Wapana":
           auth: