feat(openwrt): add archipelago-openwrt crate with TollGate provisioning

New `archipelago-openwrt` workspace crate provides SSH/UCI-based management
of OpenWrt routers, including automated TollGate installation and configuration
of a pay-as-you-go "archipelago" SSID backed by the local Cashu mint.

Exposes two RPC endpoints:
- `openwrt.scan` — discover OpenWrt routers on the LAN
- `openwrt.provision-tollgate` — install tollgate-module-basic-go, write UCI
  config (TIP-01/TIP-02), and create isolated WiFi SSID + firewall zone

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

core/openwrt/src/tollgate/config.rs

@@ -0,0 +1,56 @@
+use anyhow::Result;
+use serde::{Deserialize, Serialize};
+
+use crate::Router;
+
+/// TollGate provisioning parameters.
+///
+/// `mint_url` must be the externally-reachable URL of the Archy Cashu mint —
+/// TollGate customers connect from outside the Archy node's loopback, so
+/// localhost URLs will not work. Resolve this from the running mint app before
+/// calling `provision`.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct TollGateConfig {
+    /// SSID name for the pay-as-you-go network.
+    pub ssid: String,
+    /// Externally-reachable URL of the Archy Cashu mint.
+    pub mint_url: String,
+    /// Price in satoshis per `step_size` interval.
+    pub price_sats: u64,
+    /// Step size in milliseconds (default: 60000 = 1 minute).
+    pub step_size_ms: u64,
+    /// Minimum steps a customer must purchase at once.
+    pub min_steps: u32,
+}
+
+impl Default for TollGateConfig {
+    fn default() -> Self {
+        Self {
+            ssid: "archipelago".to_string(),
+            mint_url: String::new(), // must be set by caller from the running mint app
+            price_sats: 10,
+            step_size_ms: 60_000,
+            min_steps: 1,
+        }
+    }
+}
+
+/// Write TollGate UCI configuration and commit.
+///
+/// Maps TIP-01 / TIP-02 fields onto UCI keys used by tollgate-module-basic-go.
+pub fn apply(router: &Router, cfg: &TollGateConfig) -> Result<()> {
+    router.uci_apply(
+        "tollgate",
+        &[
+            ("tollgate.main", "tollgate"),
+            ("tollgate.main.enabled", "1"),
+            ("tollgate.main.metric", "milliseconds"),
+            ("tollgate.main.step_size", &cfg.step_size_ms.to_string()),
+            ("tollgate.main.min_steps", &cfg.min_steps.to_string()),
+            ("tollgate.main.price_per_step", &cfg.price_sats.to_string()),
+            ("tollgate.main.currency", "sat"),
+            ("tollgate.main.mint_url", &cfg.mint_url),
+        ],
+    )?;
+    Ok(())
+}

core/openwrt/src/tollgate/install.rs

@@ -0,0 +1,16 @@
+use anyhow::Result;
+use tracing::info;
+
+use crate::Router;
+
+/// The OpenWrt package name for the TollGate reference implementation.
+const TOLLGATE_PACKAGE: &str = "tollgate-module-basic-go";
+
+/// Install tollgate-module-basic-go via opkg.
+///
+/// Caller is responsible for running `opkg_update` first.
+pub fn install_tollgate(router: &Router) -> Result<()> {
+    info!("[{}] Installing {}", router.host, TOLLGATE_PACKAGE);
+    router.opkg_install(TOLLGATE_PACKAGE)?;
+    Ok(())
+}

core/openwrt/src/tollgate/mod.rs

@@ -0,0 +1,36 @@
+pub mod config;
+pub mod install;
+pub mod wifi;
+
+pub use config::TollGateConfig;
+pub use install::install_tollgate;
+pub use wifi::provision_ssid;
+
+use anyhow::Result;
+use tracing::info;
+
+use crate::Router;
+
+/// Full TollGate provisioning sequence:
+/// 1. Install tollgate-module-basic-go via opkg
+/// 2. Write TollGate UCI config (pricing, mint URL)
+/// 3. Create the pay-as-you-go WiFi SSID
+/// 4. Restart affected services
+pub async fn provision(router: &Router, config: &TollGateConfig) -> Result<()> {
+    info!("[{}] Starting TollGate provisioning", router.host);
+
+    router.opkg_update()?;
+    install_tollgate(router)?;
+    config::apply(router, config)?;
+    wifi::provision_ssid(router, config)?;
+    restart_services(router)?;
+
+    info!("[{}] TollGate provisioning complete", router.host);
+    Ok(())
+}
+
+fn restart_services(router: &Router) -> Result<()> {
+    router.run_ok("/etc/init.d/tollgate restart || true")?;
+    router.run_ok("/etc/init.d/network restart")?;
+    Ok(())
+}

core/openwrt/src/tollgate/wifi.rs

@@ -0,0 +1,106 @@
+use anyhow::{Context, Result};
+use tracing::info;
+
+use crate::tollgate::TollGateConfig;
+use crate::Router;
+
+/// Create a dedicated pay-as-you-go WiFi interface for TollGate.
+///
+/// Adds a new `wifi-iface` section on the first detected radio, sets the SSID,
+/// marks it as an open network, and ties it to a TollGate firewall zone.
+pub fn provision_ssid(router: &Router, cfg: &TollGateConfig) -> Result<()> {
+    let radio = detect_radio(router).context("detect WiFi radio")?;
+    info!("[{}] Using radio {} for TollGate SSID", router.host, radio);
+
+    // Add a new wifi-iface section; uci add returns the section name (e.g. "cfg123456").
+    let section = router.uci_add("wireless", "wifi-iface")?;
+
+    router.uci_apply(
+        "wireless",
+        &[
+            (&format!("wireless.{}.device", section), &radio),
+            (&format!("wireless.{}.mode", section), "ap"),
+            (&format!("wireless.{}.ssid", section), &cfg.ssid),
+            (&format!("wireless.{}.encryption", section), "none"),
+            (&format!("wireless.{}.network", section), "tollgate"),
+            // Disable 802.11r/k/v — unnecessary for transient pay-as-you-go clients.
+            (&format!("wireless.{}.ieee80211r", section), "0"),
+        ],
+    )?;
+
+    provision_network(router)?;
+    provision_firewall(router)?;
+
+    Ok(())
+}
+
+/// Add a `tollgate` network interface (isolated LAN for TollGate clients).
+fn provision_network(router: &Router) -> Result<()> {
+    router.uci_apply(
+        "network",
+        &[
+            ("network.tollgate", "interface"),
+            ("network.tollgate.proto", "static"),
+            ("network.tollgate.ipaddr", "192.168.99.1"),
+            ("network.tollgate.netmask", "255.255.255.0"),
+        ],
+    )?;
+
+    // Enable DHCP for the tollgate interface.
+    router.uci_apply(
+        "dhcp",
+        &[
+            ("dhcp.tollgate", "dhcp"),
+            ("dhcp.tollgate.interface", "tollgate"),
+            ("dhcp.tollgate.start", "100"),
+            ("dhcp.tollgate.limit", "150"),
+            ("dhcp.tollgate.leasetime", "5m"),
+        ],
+    )?;
+
+    Ok(())
+}
+
+/// Add firewall zone for the tollgate interface.
+///
+/// TollGate itself gates forwarding via iptables; the firewall zone isolates
+/// tollgate clients from other LAN segments.
+fn provision_firewall(router: &Router) -> Result<()> {
+    // Zone
+    router.uci_apply(
+        "firewall",
+        &[
+            ("firewall.tollgate_zone", "zone"),
+            ("firewall.tollgate_zone.name", "tollgate"),
+            ("firewall.tollgate_zone.network", "tollgate"),
+            ("firewall.tollgate_zone.input", "ACCEPT"),
+            ("firewall.tollgate_zone.output", "ACCEPT"),
+            ("firewall.tollgate_zone.forward", "REJECT"),
+        ],
+    )?;
+
+    // Forwarding rule: tollgate → wan (TollGate manages which clients can forward)
+    router.uci_apply(
+        "firewall",
+        &[
+            ("firewall.tollgate_fwd", "forwarding"),
+            ("firewall.tollgate_fwd.src", "tollgate"),
+            ("firewall.tollgate_fwd.dest", "wan"),
+        ],
+    )?;
+
+    Ok(())
+}
+
+/// Return the first available wireless radio device name (e.g. "radio0").
+fn detect_radio(router: &Router) -> Result<String> {
+    let out = router.run_ok("uci show wireless | grep -o 'wireless\\.radio[0-9]*\\.type' | head -1")?;
+    // Extract "radioN" from "wireless.radioN.type"
+    let radio = out
+        .trim()
+        .split('.')
+        .nth(1)
+        .unwrap_or("radio0")
+        .to_string();
+    Ok(radio)
+}