feat(openwrt): WAN/WISP setup from the UI with WiFi network scan

New RPC methods:
- openwrt.scan-wifi: triggers iwinfo scan on the router radio,
  returns networks sorted by signal strength
- openwrt.configure-wan: creates UCI wireless.wwan (sta mode) +
  network.wwan (DHCP) + adds wwan to firewall WAN zone, then
  calls `wifi reload`

get-status now includes a `wan` object with configured/ssid/ip/
internet fields so the UI can show current uplink state.

Frontend WAN panel: scan → pick SSID (signal bars) → enter password
→ apply. Shows "Configure WAN first" hint above TollGate install
button when internet is not available.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

core/archipelago/src/api/rpc/dispatcher.rs

@@ -234,6 +234,8 @@ impl RpcHandler {
             "openwrt.scan" => self.handle_openwrt_scan(params).await,
             "openwrt.get-status" => self.handle_openwrt_get_status(params).await,
             "openwrt.provision-tollgate" => self.handle_openwrt_provision_tollgate(params).await,
+            "openwrt.scan-wifi" => self.handle_openwrt_scan_wifi(params).await,
+            "openwrt.configure-wan" => self.handle_openwrt_configure_wan(params).await,
 
             // Ecash wallet
             "wallet.ecash-balance" => self.handle_wallet_ecash_balance().await,

core/archipelago/src/api/rpc/middleware.rs

@@ -71,6 +71,9 @@ pub(super) fn sanitize_error_message(msg: &str) -> String {
         "No pre-built TollGate",
         "opkg not found",
         "apk update failed",
+        "No wireless interface",
+        "No wireless radio",
+        "Missing required field",
     ];
     for prefix in &user_facing_prefixes {
         if msg.starts_with(prefix) {

core/archipelago/src/api/rpc/openwrt.rs

@@ -4,6 +4,8 @@ use archipelago_openwrt::{
     detect,
     router::Router,
     tollgate::{self, TollGateConfig},
+    wan,
+    wifi_scan,
 };
 use crate::network::router as net_router;
 
@@ -114,6 +116,8 @@ impl RpcHandler {
         let wifi_raw = router.run_ok("uci show wireless").unwrap_or_default();
         let wifi_interfaces = parse_wifi_interfaces(&wifi_raw);
 
+        let wan_status = wan::get_wan_status(&router);
+
         Ok(serde_json::json!({
             "host": host,
             "hostname": hostname,
@@ -121,6 +125,7 @@ impl RpcHandler {
             "release": parse_release(&release),
             "tollgate": tollgate,
             "wifi_interfaces": wifi_interfaces,
+            "wan": wan_status,
         }))
     }
 
@@ -190,6 +195,74 @@ impl RpcHandler {
             "mint_url": config.mint_url,
         }))
     }
+
+    /// Scan for visible WiFi networks from the router's radio.
+    ///
+    /// Params: same host/credentials as other openwrt methods.
+    pub(super) async fn handle_openwrt_scan_wifi(
+        &self,
+        params: Option<serde_json::Value>,
+    ) -> Result<serde_json::Value> {
+        let saved = net_router::load_router_config(&self.config.data_dir).await?;
+        let p = params.unwrap_or_default();
+
+        let host = p.get("host").and_then(|v| v.as_str()).map(|s| s.to_string())
+            .or_else(|| if saved.configured { Some(saved.address.clone()) } else { None })
+            .ok_or_else(|| anyhow::anyhow!("No router configured — provide host or call router.configure first"))?;
+        let ssh_user = p.get("ssh_user").and_then(|v| v.as_str()).map(|s| s.to_string())
+            .or_else(|| saved.username.clone()).unwrap_or_else(|| "root".to_string());
+        let ssh_password = p.get("ssh_password").and_then(|v| v.as_str()).map(|s| s.to_string())
+            .or_else(|| saved.password.clone()).unwrap_or_default();
+
+        let router = Router::connect_password(&host, 22, &ssh_user, &ssh_password)?;
+        router.verify_openwrt()?;
+
+        let networks = wifi_scan::scan_networks(&router)?;
+        let result: Vec<serde_json::Value> = networks
+            .iter()
+            .map(|n| serde_json::json!({
+                "ssid":       n.ssid,
+                "bssid":      n.bssid,
+                "signal":     n.signal,
+                "channel":    n.channel,
+                "encryption": n.encryption,
+            }))
+            .collect();
+
+        Ok(serde_json::json!({ "networks": result }))
+    }
+
+    /// Configure WAN/WISP — connect the router to an upstream WiFi network.
+    ///
+    /// Params: host/credentials + `{ "ssid": "...", "password": "...", "encryption": "psk2" }`
+    pub(super) async fn handle_openwrt_configure_wan(
+        &self,
+        params: Option<serde_json::Value>,
+    ) -> Result<serde_json::Value> {
+        let saved = net_router::load_router_config(&self.config.data_dir).await?;
+        let p = params.unwrap_or_default();
+
+        let host = p.get("host").and_then(|v| v.as_str()).map(|s| s.to_string())
+            .or_else(|| if saved.configured { Some(saved.address.clone()) } else { None })
+            .ok_or_else(|| anyhow::anyhow!("No router configured — provide host or call router.configure first"))?;
+        let ssh_user = p.get("ssh_user").and_then(|v| v.as_str()).map(|s| s.to_string())
+            .or_else(|| saved.username.clone()).unwrap_or_else(|| "root".to_string());
+        let ssh_password = p.get("ssh_password").and_then(|v| v.as_str()).map(|s| s.to_string())
+            .or_else(|| saved.password.clone()).unwrap_or_default();
+
+        let ssid = p.get("ssid").and_then(|v| v.as_str())
+            .ok_or_else(|| anyhow::anyhow!("Missing required field: ssid"))?.to_string();
+        let password = p.get("password").and_then(|v| v.as_str()).unwrap_or("").to_string();
+        let encryption = p.get("encryption").and_then(|v| v.as_str()).unwrap_or("psk2").to_string();
+
+        let router = Router::connect_password(&host, 22, &ssh_user, &ssh_password)?;
+        router.verify_openwrt()?;
+
+        let config = wan::WispConfig { ssid: ssid.clone(), password, encryption };
+        wan::configure_wisp(&router, &config)?;
+
+        Ok(serde_json::json!({ "ok": true, "host": host, "ssid": ssid }))
+    }
 }
 
 /// Parse /etc/openwrt_release key=value pairs into a JSON object.