fix(openwrt): TollGate apk-native install for OpenWrt 25.x

- WISP wizard: step-by-step flow for WiFi, DHCP, masquerade config
- WAN status: expose lan_ip, dhcp_start/limit, masq, sta_state, wifi_log
- wifi_scan: detect CCMP as WPA2 (psk2) so association succeeds
- opkg: PkgManager enum — detect apk-native mode when opkg not in repos
- tollgate: apk-native install path using manual ipk extraction
- arch detection: read DISTRIB_ARCH from /etc/openwrt_release; normalise
  bare mipsel/mips from uname -m to mipsel_24kc/mips_24kc
- install_ipk: install binutils via apk when ar not in BusyBox
- install_ipk: wget --no-check-certificate for routers without CA bundle
- install_ipk: ar fallback to tar -xzf for non-standard ipk formats
- install_ipk: 5MB overlay space check with clear user-facing error
- middleware: allow "Not enough flash/space" errors through sanitizer

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

core/archipelago/src/api/rpc/middleware.rs

@@ -67,6 +67,8 @@ pub(super) fn sanitize_error_message(msg: &str) -> String {
         "No router",
         "No OpenWrt",
         "No space left",
+        "Not enough flash",
+        "Not enough space",
         "TollGate installation failed",
         "No pre-built TollGate",
         "opkg not found",

core/archipelago/src/api/rpc/openwrt.rs

@@ -92,9 +92,10 @@ impl RpcHandler {
             .and_then(|s| s.parse().ok())
             .unwrap_or(0);
 
-        // TollGate
+        // TollGate — check via opkg (≤24.x) or binary presence (25.x apk-native)
         let tollgate_installed = router
-            .run("/usr/bin/opkg list-installed | grep -q '^tollgate-module-basic-go '")
+            .run("/usr/bin/opkg list-installed 2>/dev/null | grep -q '^tollgate-module-basic-go ' || \
+                  test -f /usr/bin/tollgate-module-basic-go 2>/dev/null")
             .map(|(_, code)| code == 0)
             .unwrap_or(false);
 
@@ -254,11 +255,14 @@ impl RpcHandler {
             .ok_or_else(|| anyhow::anyhow!("Missing required field: ssid"))?.to_string();
         let password = p.get("password").and_then(|v| v.as_str()).unwrap_or("").to_string();
         let encryption = p.get("encryption").and_then(|v| v.as_str()).unwrap_or("psk2").to_string();
+        let dhcp_start = p.get("dhcp_start").and_then(|v| v.as_u64()).unwrap_or(100) as u32;
+        let dhcp_limit = p.get("dhcp_limit").and_then(|v| v.as_u64()).unwrap_or(150) as u32;
+        let masq = p.get("masq").and_then(|v| v.as_bool()).unwrap_or(true);
 
         let router = Router::connect_password(&host, 22, &ssh_user, &ssh_password)?;
         router.verify_openwrt()?;
 
-        let config = wan::WispConfig { ssid: ssid.clone(), password, encryption };
+        let config = wan::WispConfig { ssid: ssid.clone(), password, encryption, dhcp_start, dhcp_limit, masq };
         wan::configure_wisp(&router, &config)?;
 
         Ok(serde_json::json!({ "ok": true, "host": host, "ssid": ssid }))