Template remaining host-specific values (WAN wifi, LAN/eth0, NVMe, nftables)

nftables.conf hardcoded the R5C network, van-br0-setup.service the R5C
interfaces and several configs wlan0/eth0. All now come from the host
config; the onboard LAN port is skipped when ONBOARD_LAN_IFACE is empty.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/check-templates.sh

@@ -33,4 +33,40 @@ else
     diff <(echo "$known") <(echo "$defined") | sed 's/^/       /' || true
 fi
 
+# 2. every file carrying an @TOKEN@ is installed through install_rendered
+#    (plain `install` would ship the placeholder unrendered — the 2026-09-23 failure)
+# vanrouter.js: installed by the loop in the cockpit block; 50-van-wan.yaml: reference copy,
+# rendered by hand via `deploy.sh render` (deploy.sh only warns when it differs)
+exempt=" cockpit/vanrouter/vanrouter.js ap/50-van-wan.yaml "
+for f in $(./deploy.sh --templates); do
+    case "$exempt" in *" $f "*) continue ;; esac
+    if grep -qE "^[[:space:]]*install_rendered +$f[[:space:]]" deploy.sh; then
+        ok "install_rendered $f"
+    else
+        bad "$f contains an @TOKEN@ but deploy.sh does not install it with install_rendered"
+    fi
+done
+
+# 5. host-specific values land in the rendered output
+r() { VANLINK_CONF="hosts/$1.conf" ./deploy.sh render "$2"; }
+expect() {  # expect <host> <file> <fixed string that must appear>
+    if r "$1" "$2" | grep -qF -- "$3"; then ok "$1: $2 has '$3'"; else bad "$1: $2 lacks '$3'"; fi
+}
+expect van ap/nftables.conf            'ip saddr 10.42.1.0/24'
+expect wan ap/nftables.conf            'ip saddr 10.42.0.0/24'
+expect van ap/van-br0-setup.service    'brctl addif br0 enP1p17s0'
+expect wan ap/van-br0-setup.service    'brctl addif br0 enx00e04c331140'
+expect van failover/config.json        '"device": "wlan0"'
+expect van router-status/config.json   '"wifi_wan_iface": "wlan0"'
+expect van failover/van-wlan-watchdog.service 'van-wlan-watchdog wlan0'
+expect van ap/van-ap-unmanaged.conf    'interface-name:enP1p17s0'
+expect wan ap/van-ap-unmanaged.conf    'interface-name:enx00e04c331140;interface-name:eth0'
+expect wan ap/23-van-lan-eth0.network  'Name=eth0'
+expect van power/nvme-watch-config.json '"nvme_device": ""'
+if r van ap/van-ap-unmanaged.conf | grep -q 'eth0'; then
+    bad "van: unmanaged-devices must not mention eth0 (ONBOARD_LAN_IFACE is empty)"
+else
+    ok "van: unmanaged-devices has no eth0"
+fi
+
 exit "$fail"