port to Pi 4 'wan': onboard eth0+wlan0 as NM WANs, AP stack verbatim

The USB hub (5GHz + 2.4GHz AP dongles, Starlink + LAN RTL8153s) moves over
from wayback; MAC-derived wlx*/enx* names travel with it, so hostapd/
networkd/cockpit configs are unchanged. Pi diffs only: failover WAN list
(wlan0 wifi 100, eth0 150, starlink USB 200, Koodo 300), cpu_thermal
sensor, bcm2835 watchdog 10s, no HA DNAT/lease, and deploy.sh drops
battery/lid/heartbeat/ZT-dns. Netplan reference in ap/50-van-wan.yaml.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ap/nftables.conf

@@ -4,20 +4,8 @@
 table ip van_router_nat
 delete table ip van_router_nat
 table ip van_router_nat {
-    chain prerouting {
-        type nat hook prerouting priority dstnat; policy accept;
-        # Home Assistant VM (ha_van) is bridged onto br0 at 10.42.0.50 — clients reach
-        # it directly. Keep the legacy http://10.42.0.1:8123 URL working for anything
-        # that bookmarked it (phones, ZT clients).
-        ip daddr 10.42.0.1 tcp dport 8123 dnat to 10.42.0.50:8123
-    }
     chain postrouting {
         type nat hook postrouting priority srcnat; policy accept;
         ip saddr 10.42.0.0/24 oifname != "br0" masquerade
-        # Hairpin for the legacy 10.42.0.1:8123 DNAT when the client sits on the same
-        # subnet as the HA VM: without masquerade the VM would reply directly on br0
-        # from 10.42.0.50 and the client (expecting 10.42.0.1) would drop it. ZT-sourced
-        # traffic doesn't match and doesn't need it — VM replies route back through us.
-        ip saddr 10.42.0.0/24 ip daddr 10.42.0.50 tcp dport 8123 oifname "br0" masquerade
     }
 }