ap: bridge wired LAN port (enx00e04c331140) into br0 with the AP

Add a wired LAN port on the same 10.42.0.0/24 segment as VanLink WiFi by
bridging both into br0. The gateway IP, dnsmasq, and NAT move off the wlan name
onto br0; hostapd (not networkd) enslaves the wlan via bridge=br0, since a
station-mode wlan can't be bridged until it's in AP mode. NM leaves the wired
port unmanaged so networkd owns it. Failover/Starlink (enxd8ec5eeb3512)
untouched.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -16,11 +16,12 @@ This directory is the source of truth. The live system files live under `/etc`,
 ## 1. Architecture at a glance
 
 ```
-            clients ──WiFi(VanLink, 5GHz ch149, 80MHz WPA2)
-                          │
-        wlxc83a35a4ee55  (Realtek RTL8852BU, rtw89)  10.42.0.1/24   ← AP, hostapd
+     WiFi clients (VanLink, 5GHz ch149, 80MHz WPA2)   wired LAN clients
+        wlxc83a35a4ee55 (RTL8852BU, rtw89, hostapd)   enx00e04c331140
+                          └───────────┬───────────────────┘
+                                br0   10.42.0.1/24   ← LAN bridge
                           │  dnsmasq DHCP .10–.254 + DNS
-                          │  nftables masquerade (oifname != AP)
+                          │  nftables masquerade (oifname != br0)
                           │  ip_forward=1
         ┌─────────────────┼──────────────────────────────────────┐
    wlp1s0 (m100)     enxd8ec5eeb3512 (m200)        Koodo gsm (m300)
@@ -34,8 +35,8 @@ This directory is the source of truth. The live system files live under `/etc`,
 | Concern | Owner |
 |---|---|
 | WAN interfaces (eth / wifi / gsm), DHCP-client, metrics | **NetworkManager** |
-| AP interface IP (10.42.0.1) | **systemd-networkd** (`10-van-ap.network`) |
-| AP beaconing / WPA | **hostapd** (AP iface is NM-*unmanaged*) |
+| LAN bridge `br0` + IP (10.42.0.1) + wired LAN member | **systemd-networkd** (`2x-van-br0/lan`) |
+| AP beaconing / WPA + adding the wlan to `br0` | **hostapd** (`bridge=br0`; AP iface + wired port are NM-*unmanaged*) |
 | AP DHCP + DNS | **dnsmasq** (dedicated instance, bound to AP only) |
 | NAT + forwarding | **nftables** + sysctl |
 | WAN health + failover | **van-failover** daemon |
@@ -47,7 +48,7 @@ This directory is the source of truth. The live system files live under `/etc`,
 | Web UI | **Cockpit** + `vanrouter` plugin |
 
 ### Key network facts
-- AP LAN: `10.42.0.0/24`, gateway/AP `10.42.0.1`, DHCP `.10–.254`.
+- LAN: `10.42.0.0/24`, gateway `10.42.0.1`, DHCP `.10–.254` — shared by Wi-Fi (`VanLink`) and the wired port `enx00e04c331140`, both bridged into `br0`.
 - WAN priority (metrics): **wifi 100 → eth/Starlink 200 → 4G 300** (lower = preferred).
 - Management / recovery: ethernet `192.168.10.251`, wifi `192.168.10.27`, ZeroTier `192.168.196.22`.
 - Cockpit: `https://192.168.10.251:9090` (or `.27`, or ZeroTier). Log in with a Unix account; enable *Administrative access* for action buttons.
@@ -67,9 +68,12 @@ This directory is the source of truth. The live system files live under `/etc`,
 | `default-hostapd` | `/etc/default/hostapd` | `DAEMON_CONF=...` |
 | `van-ap-dnsmasq.conf` | `/etc/van-ap/dnsmasq.conf` | DHCP/DNS bound to AP iface (`bind-dynamic`, so it does not clash with systemd-resolved) |
 | `van-ap-dnsmasq.service` | `/etc/systemd/system/van-ap-dnsmasq.service` | dedicated dnsmasq unit (uses the `dnsmasq-base` binary; the distro dnsmasq service is NOT used) |
-| `10-van-ap.network` | `/etc/systemd/network/10-van-ap.network` | static `10.42.0.1/24` on the AP iface (`ConfigureWithoutCarrier`) |
-| `van-ap-unmanaged.conf` | `/etc/NetworkManager/conf.d/van-ap-unmanaged.conf` | tells NM to leave the AP iface alone |
-| `nftables.conf` | `/etc/nftables.conf` | NAT: `masquerade ip saddr 10.42.0.0/24 oifname != <AP>` → follows whatever WAN is active |
+| `10-van-ap.network` | `/etc/systemd/network/10-van-ap.network` | brings the AP wlan up with **no** IP (it's a `br0` member; hostapd enslaves it) |
+| `20-van-br0.netdev` | `/etc/systemd/network/20-van-br0.netdev` | creates the LAN bridge `br0` (STP off) |
+| `21-van-br0.network` | `/etc/systemd/network/21-van-br0.network` | static `10.42.0.1/24` on `br0` (`ConfigureWithoutCarrier`) |
+| `22-van-lan.network` | `/etc/systemd/network/22-van-lan.network` | enslaves the wired LAN port `enx00e04c331140` to `br0` |
+| `van-ap-unmanaged.conf` | `/etc/NetworkManager/conf.d/van-ap-unmanaged.conf` | tells NM to leave the AP wlan **and** the wired LAN port alone |
+| `nftables.conf` | `/etc/nftables.conf` | NAT: `masquerade ip saddr 10.42.0.0/24 oifname != br0` → follows whatever WAN is active |
 | `99-van-router.conf` | `/etc/sysctl.d/99-van-router.conf` | `net.ipv4.ip_forward=1` |
 | `regdomain.service` | `/etc/systemd/system/regdomain.service` | `iw reg set CA` at boot, before NetworkManager |
 | `rtw89.conf` | `/etc/modprobe.d/rtw89.conf` | `options rtw89_core disable_ps_mode=Y` (else AP drops beacon when idle) |