router-control: automate setup and harden installation

[katovpn]

Summary

• Remove AdBlock management from Router Control, including UI, package probes, installer and API. Existing router packages remain untouched.
• Recognize compatible legacy profiles without requiring a new ownership marker or exact profile name; expose specific read-only mismatch diagnostics.
• Preserve the installation hardening, apk diagnostics, operation-scoped rollback timers, and dashboard refresh from the original PR.
• Add one automatic setup action for missing, manually installed, drifted, and already managed Nikki/Mihomo installations.
• Keep subscription country policies server-owned; use the contract User-Agent and a neutral local profile.
• Detect additional network settings read-only and show a generic warning without changing third-party configuration.

Safety notes

• This is a source-only candidate. No router/server operations, EXE build, tag, merge, or release were performed.
• Keep pinned SSH identity, exclusive jobs, backups, package transaction simulation, and rollback protections.
• Verify final setup and Mihomo runtime configuration inside the rollback boundary, including subscription refresh.
• Package installation is not reversed by configuration rollback; errors retain this distinction.
• End-to-end LAN connectivity is not claimed by mocked tests or router-side checks.

Files changed

• Python setup assessment, orchestration, API, and dashboard.
• Generic setup UI, neutral UCI profile, and manifest.
• Python and JavaScript regression tests; CI/release test steps and documentation.

Verification performed

• 122 Python tests passed on Python 3.12.13 with pinned dependencies; 7 Node UI tests passed.
• JavaScript syntax and Python compilation checks.
• Public-source audit: 38 files, zero findings.
• Pinned dependency audit: no known vulnerabilities.
• Independent API/core review; reported findings resolved with regression tests.
• Git diff whitespace check.

Approval required

• Keep draft until live 5 GHz Wi-Fi, auto-refresh, apk TLS diagnostics/recovery, and existing third-party DNS coexistence checks are complete.
• Live access requires a new explicit request and a fresh limited session.
• Review and hardware verification are required before merge, a new EXE, or release.