feat: kit-busrouter v2.0 — complete Synology + GL fleet router platform

Includes:
- package/ GL-XE3000 kit-busrouter (opkg)
- scripts/provision.sh (GL) and provision-synology.sh (Synology)
- syno-balance/ — new WAN balancer replacing aiwanbal (SmartWAN adapter)
- kit-connect/ — unified connectivity SPK (Tailscale + reverse SSH)
- docs/deployment/synology-rt2600ac-checklist.md — 62-point checklist
- docs/provisioning/device-identity.md — fleet identity spec
- docs/pilot/checklist.md — field pilot validation
- x4078_20260721.dss — reference config backup

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

kit-connect/conf/connect.conf

@@ -0,0 +1,31 @@
+# kit-connect — Unified router connectivity config
+# One SPK, all routers. Hub assigns ports and keys.
+# Edit this file or re-run postinst to re-register with hub.
+
+# ── Device Identity ─────────────────────────────────────────────────
+DEVICE_ID="REPLACE_WITH_DEVICE_ID"
+
+# ── Hub Registration ────────────────────────────────────────────────
+HUB_HOST="162.243.83.36"
+HUB_PORT="8080"
+
+# ── Reverse SSH Tunnel ──────────────────────────────────────────────
+# Port 0 = auto-assign via hub registration
+TUNNEL_ENABLE=1
+TUNNEL_REMOTE_HOST="162.243.83.36"
+TUNNEL_REMOTE_USER="node"
+TUNNEL_REMOTE_SSH_PORT="22"
+TUNNEL_REMOTE_PORT="0"
+TUNNEL_LOCAL_SSH_PORT="2223"
+TUNNEL_RETRY_DELAY="30"
+
+# ── Tailscale ──────────────────────────────────────────────────────
+TAILSCALE_ENABLE=1
+TAILSCALE_STATEDIR="/var/packages/Tailscale/var/state"
+TAILSCALE_SOCKET="/var/packages/Tailscale/var/run/tailscaled.sock"
+TAILSCALE_AUTH_KEY="tskey-auth-kJz8wqNVo211CNTRL-GNL5EFjp5aWQcaWPSVn2aW9TNworKUNBV"
+TAILSCALE_HOSTNAME=""
+
+# ── Behaviour ──────────────────────────────────────────────────────
+WATCHDOG_INTERVAL=60
+FORWARD_FAIL_LIMIT=2