port to Pi 4 'wan': onboard eth0+wlan0 as NM WANs, AP stack verbatim

The USB hub (5GHz + 2.4GHz AP dongles, Starlink + LAN RTL8153s) moves over
from wayback; MAC-derived wlx*/enx* names travel with it, so hostapd/
networkd/cockpit configs are unchanged. Pi diffs only: failover WAN list
(wlan0 wifi 100, eth0 150, starlink USB 200, Koodo 300), cpu_thermal
sensor, bcm2835 watchdog 10s, no HA DNAT/lease, and deploy.sh drops
battery/lid/heartbeat/ZT-dns. Netplan reference in ap/50-van-wan.yaml.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ap/50-van-wan.yaml

@@ -0,0 +1,24 @@
+# /etc/netplan/50-van-wan.yaml — replaces cloud-init's 50-cloud-init.yaml.
+# Both onboard interfaces are WANs handed to NetworkManager so van-failover can
+# steer them (mirrors wayback where NM owns all WANs): wlan0 = wifi uplink
+# (Wapana at home / campsite wifi), eth0 = ethernet uplink. The AP radios and
+# the wired LAN port (USB dongles, wlx*/enx* MAC-named) are deliberately absent:
+# systemd-networkd/hostapd own them, and van-ap-unmanaged.conf hides them from NM.
+# Apply once by hand: netplan generate && netplan apply (flaps both uplinks).
+network:
+  version: 2
+  ethernets:
+    eth0:
+      renderer: NetworkManager
+      optional: true
+      dhcp4: true
+  wifis:
+    wlan0:
+      renderer: NetworkManager
+      optional: true
+      dhcp4: true
+      access-points:
+        "Wapana":
+          auth:
+            key-management: "psk"
+            password: "6e1335fd97165a7d2618bec19824be363a2766d7765f91aa14773d871eaa59dc"