ap: keep AP beaconing across USB re-enumeration

Starlink's USB ethernet shares a hub with the rtw89 Wi-Fi adapter; when Starlink
flaps, the hub re-enumerates and tears the radio down, so hostapd loses its
interface and exits. Two stock defaults left the AP dark: Restart=on-failure
misses clean exits, and the 5-in-10s start limit makes systemd give up during a
re-enumeration storm.

- hostapd-restart.conf drop-in: Restart=always, RestartSec=5, StartLimitIntervalSec=0
  so hostapd retries forever until the interface returns (verified: SIGKILL -> back
  to state=ENABLED in ~7s).
- van-ap-watchdog daemon: backstop for the case systemd can't see (hostapd running
  but radio wedged). Polls hostapd_cli status; restarts hostapd if the iface is
  present but not ENABLED, waits it out if the iface is mid-re-enumeration.
- hostapd.conf: add ctrl_interface so the watchdog can read the real AP state.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deploy.sh

@@ -9,7 +9,10 @@ cd "$(dirname "$(readlink -f "$0")")"
 
 echo "== access point =="
 install -D -m0644 ap/hostapd.conf           /etc/hostapd/hostapd.conf
+install -D -m0644 ap/hostapd-restart.conf   /etc/systemd/system/hostapd.service.d/restart.conf
 install -D -m0644 ap/default-hostapd        /etc/default/hostapd
+install -D -m0755 ap/van-ap-watchdog        /usr/local/sbin/van-ap-watchdog
+install -D -m0644 ap/van-ap-watchdog.service /etc/systemd/system/van-ap-watchdog.service
 install -D -m0644 ap/van-ap-dnsmasq.conf    /etc/van-ap/dnsmasq.conf
 install -D -m0644 ap/van-ap-dnsmasq.service /etc/systemd/system/van-ap-dnsmasq.service
 install -D -m0644 ap/10-van-ap.network      /etc/systemd/network/10-van-ap.network
@@ -82,7 +85,7 @@ systemctl mask systemd-networkd-wait-online.service >/dev/null 2>&1 || true
 # pick up the lid drop-in (re-execs logind; does NOT drop the network)
 systemctl restart systemd-logind >/dev/null 2>&1 || true
 systemctl unmask hostapd >/dev/null 2>&1 || true
-systemctl enable regdomain.service hostapd van-ap-dnsmasq nftables systemd-networkd van-failover van-thermal van-battery >/dev/null 2>&1 || true
+systemctl enable regdomain.service hostapd van-ap-dnsmasq nftables systemd-networkd van-failover van-thermal van-battery van-ap-watchdog >/dev/null 2>&1 || true
 systemctl restart van-thermal van-battery
 # Heartbeat: only enable/start once the client binary is installed (README §4).
 if [ -x /home/andreas/bin/hbc ]; then
@@ -96,6 +99,8 @@ nmcli general reload 2>/dev/null || systemctl reload NetworkManager 2>/dev/null
 # the wlan to br0, then dnsmasq binds br0, then NAT/failover
 systemctl restart systemd-networkd
 systemctl restart hostapd van-ap-dnsmasq nftables van-failover
+# AP watchdog last, after hostapd is back up (it only ever restarts a wedged hostapd)
+systemctl restart van-ap-watchdog
 networkctl reload 2>/dev/null || true
 
 echo