[WIP] Add NTP pre-auth support for TollGate clients

[Copilot]

Thanks for asking me to work on this. I will get started on it and keep this PR's description up to date as I form a plan and make progress.

---

This section details on the original issue you should resolve

<issue_title>feature: TollGate should serve NTP (udp/123) pre-auth to portal clients — downstream TollGates need accurate time before they can pay</issue_title>
<issue_description>From the ws3915i fleet bring-up (conwrt-bench): a downstream TollGate (reseller mode) or wallet client joins the open portal pre-auth with a possibly-wrong clock (our units sat 2 months off). Cashu proofs carry timestamps, keysets expire, sessions are time-boxed — clients should be able to sync BEFORE paying. NTP-to-the-gateway is the same free-pre-auth-infrastructure class as the DNS allowlist: cheap, safe, and it makes chained TollGates self-sufficient. Suggested: busybox ntpd -l on the gateway + udp 123 in the default preauthenticated/users_to_router allowlist. Bench-side already implemented and verified (79b1 answers NTP on the portal face, clients sync from the gateway).</issue_description>

• Closes feature: TollGate should serve NTP (udp/123) pre-auth to portal clients — downstream TollGates need accurate time before they can pay #627

Comments on the Issue (you are @copilot in this section)

• Fixes feature: TollGate should serve NTP (udp/123) pre-auth to portal clients — downstream TollGates need accurate time before they can pay #627

[Amperstrand]

Status note (reviewer triage): this PR is still empty (0 files, 0+/0−) a day after opening.

The underlying issue (#627) is small and already bench-implemented per its own text: busybox ntpd -l on the gateway + udp/123 in the default users_to_router pre-auth allowlist, with a uci-defaults test alongside the existing ones (tests/uci-defaults-*_test.sh shapes). If this PR stays idle, it's a half-day PR for whoever picks it up — the decision content (why NTP pre-auth is the same class as the DNS allowlist) is already written in the issue. Not urgent for 0.6.0 (it's a reseller-chain improvement, not a release gate), but cheap.