feat(setup): the gateway serves NTP pre-auth — time before payment (#627)

[Amperstrand]

What

The module half of #627: the gateway serves time to its own clients, before authentication.

A pre-authentication client needs one thing beyond the portal and the payment API: accurate time. A client on the open portal joins with whatever clock it boots with (the ws3915i fleet sat months off), and a wrong clock cannot pay honestly — Cashu proofs carry timestamps, keysets expire, sessions are time-boxed — and a downstream TollGate in reseller mode needs accurate time before it can pay us at all. NTP-to-the-gateway is the same free-pre-auth-infrastructure class as the DNS allowlist: cheap, safe, and it makes chained TollGates self-sufficient.

The change

• setup_ntp_server enables busybox sysntpd's listener — system.ntp.enable_server='1' is the whole server half of the option — idempotently, creating the timeserver section when the image shipped none. An operator-disabled server is re-enabled: this is policy, not preference. The client half (upstream polling) keeps whatever the image shipped.
• The pre-auth allow list (assert_nodogsplash_allow_entries, the ONE writer both setup paths share) gains allow udp port 123 beside :2050/:2051/:2121, in the same idempotent add shape — so both the full-setup and same-version paths converge it, and the list's doc block now names NTP in the enumerated set with the rationale.
• Restart discipline follows the script's rule (see converge_nodogsplash_runtime): a running sysntpd gets exactly one cheap restart — a stateless UDP responder drops no customer, unlike the wireless or firewall services — and a fresh boot touches nothing, since procd starts sysntpd after uci-defaults with this config already committed.

Evidence (offline, per the estate's contract)

Check	Result
tests/uci-defaults-ntp-preauth_test.sh (new)	6 passed, 0 failed — section creation, enable_server=1, idempotent second run, re-enable policy, running-restart-exactly-once, fresh-boot-leaves-init-untouched
tests/uci-defaults-nodogsplash-convergence_test.sh	29 passed, 0 failed — CORE_ENTRIES now carries udp/123, so the allowlist half is exercised through the full script run with the shims
tests/uci-defaults-setup-marker-order_test.sh	159 passed, 0 failed — the new driver call breaks no ordering contract
bash -n on the setup script	clean

Bench-side, the issue already records the mechanism verified on the fleet bring-up (79b1 answers NTP on the portal face; clients sync from the gateway) — this PR lands that behavior in the shipped writer, with the same convergence guarantees the rest of the allowlist has.

On #642: that PR (opened by the Copilot agent against this same issue) is still effectively empty — one commit, zero changed files, verified via the API today. With this implementation landing, it should be closed as superseded; its task notes carried the same shape and none of the code.

Closes #627.

[Amperstrand]

Orchestrator review — technically sound; sequencing contradiction to resolve before merge.

The engineering is right: pre-auth udp/123 scoped into the existing allow-list construction (idempotent uci add_list guarded), sysntpd listener enabled idempotently, and the "restart the stateless UDP responder, never fresh-boot" rationale is correct (procd starts sysntpd after uci-defaults). The motivation is real — a wrong-clock client cannot pay honestly, and the ws3915i fleet sat months off.

The flag: the rc1 lane's close-out holds this PR out per the feature freeze, yet this diff's changelog entry lands under [v0.6.0-rc1] — and rc1 is not yet tagged. Both can't be true: either it's in the RC (then the freeze call changes and the lane should re-verify the RC gate with it), or it's held for the next cycle (then move the changelog entry to [Unreleased]). Owner/release-lane call — recommend resolving before any rc1 tag is cut so the changelog doesn't lie about what the tag contains.