port to Pi 4 'wan': onboard eth0+wlan0 as NM WANs, AP stack verbatim

The USB hub (5GHz + 2.4GHz AP dongles, Starlink + LAN RTL8153s) moves over
from wayback; MAC-derived wlx*/enx* names travel with it, so hostapd/
networkd/cockpit configs are unchanged. Pi diffs only: failover WAN list
(wlan0 wifi 100, eth0 150, starlink USB 200, Koodo 300), cpu_thermal
sensor, bcm2835 watchdog 10s, no HA DNAT/lease, and deploy.sh drops
battery/lid/heartbeat/ZT-dns. Netplan reference in ap/50-van-wan.yaml.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ap/50-van-wan.yaml

@@ -0,0 +1,24 @@
+# /etc/netplan/50-van-wan.yaml — replaces cloud-init's 50-cloud-init.yaml.
+# Both onboard interfaces are WANs handed to NetworkManager so van-failover can
+# steer them (mirrors wayback where NM owns all WANs): wlan0 = wifi uplink
+# (Wapana at home / campsite wifi), eth0 = ethernet uplink. The AP radios and
+# the wired LAN port (USB dongles, wlx*/enx* MAC-named) are deliberately absent:
+# systemd-networkd/hostapd own them, and van-ap-unmanaged.conf hides them from NM.
+# Apply once by hand: netplan generate && netplan apply (flaps both uplinks).
+network:
+  version: 2
+  ethernets:
+    eth0:
+      renderer: NetworkManager
+      optional: true
+      dhcp4: true
+  wifis:
+    wlan0:
+      renderer: NetworkManager
+      optional: true
+      dhcp4: true
+      access-points:
+        "Wapana":
+          auth:
+            key-management: "psk"
+            password: "6e1335fd97165a7d2618bec19824be363a2766d7765f91aa14773d871eaa59dc"

ap/nftables.conf

@@ -4,20 +4,8 @@
 table ip van_router_nat
 delete table ip van_router_nat
 table ip van_router_nat {
-    chain prerouting {
-        type nat hook prerouting priority dstnat; policy accept;
-        # Home Assistant VM (ha_van) is bridged onto br0 at 10.42.0.50 — clients reach
-        # it directly. Keep the legacy http://10.42.0.1:8123 URL working for anything
-        # that bookmarked it (phones, ZT clients).
-        ip daddr 10.42.0.1 tcp dport 8123 dnat to 10.42.0.50:8123
-    }
     chain postrouting {
         type nat hook postrouting priority srcnat; policy accept;
         ip saddr 10.42.0.0/24 oifname != "br0" masquerade
-        # Hairpin for the legacy 10.42.0.1:8123 DNAT when the client sits on the same
-        # subnet as the HA VM: without masquerade the VM would reply directly on br0
-        # from 10.42.0.50 and the client (expecting 10.42.0.1) would drop it. ZT-sourced
-        # traffic doesn't match and doesn't need it — VM replies route back through us.
-        ip saddr 10.42.0.0/24 ip daddr 10.42.0.50 tcp dport 8123 oifname "br0" masquerade
     }
 }

ap/van-ap-dnsmasq.conf

@@ -5,8 +5,5 @@ domain-needed
 bogus-priv
 dhcp-authoritative
 dhcp-range=10.42.0.10,10.42.0.254,255.255.255.0,12h
-# Home Assistant VM (libvirt ha_van, bridged onto br0) — pinned address, resolves
-# as "homeassistant" via this dnsmasq; HAOS also announces homeassistant.local (mDNS).
-dhcp-host=52:54:00:ad:0a:01,10.42.0.50,homeassistant
 dhcp-option=option:router,10.42.0.1
 dhcp-option=option:dns-server,10.42.0.1