setup wizard: fix routing, DHCP, WiFi AP, firewall, and deploy task

Setup script fixes:
- _cidr_to_mask: pad to 4 octets (/24 -> 255.255.255.0)
- UCI quoting: remove embedded shell quotes from uci set calls
- Bridge ports: auto-detect zt* interface instead of hardcoding ztabc0
- Bridge netmask: default to /23 (255.255.254.0) for ZT+WIBLAN
- DHCP/WiFi AP: reference interface name (zt_wiblan) not device name (br_zt)
- Firewall zone: add zt_wiblan to LAN zone for nftables fw4
- ZT IP persistence: ensure ZT-assigned IP stays on interface for ARP
- Exit gateway routing: table 100/101 route via exit gateway, not self
- New setup-wifi-ap subcommand for WIBLAN WiFi AP

UBUS handler:
- Add setup-wifi-ap to validation regex and error message

Deploy task:
- Auto-discover files from root/ and htdocs/ instead of hardcoded list
- Clear LuCI cache before restarting services

Documentation:
- New docs/SETUP-GATEWAY.md with architecture, config, pitfalls, checklist
- Updated docs/INSTALL.md with deploy task and setup wizard sections
- Updated docs/PROGRESS.md with session log and learnings

.omp/plans/install-docs-and-deploy-task.md

@@ -0,0 +1,75 @@
+# Plan: Document installation guide + add deploy mise task
+
+## What
+
+1. Create `docs/INSTALL.md` — installation guide for luci-app-zt-gateway covering all methods
+2. Add `deploy:install` task to `mise.toml` — one-command SCP + install to a real OpenWrt device
+
+## 1. `docs/INSTALL.md`
+
+New file covering all 6 installation methods, researched from official OpenWrt docs:
+
+| Method | When to use |
+|---|---|
+| **LuCI web UI** | End users, official feeds |
+| **CLI** (`apk add` / `opkg install`) | Headless / SSH users |
+| **Custom feed** | Distributing third-party packages via HTTP |
+| **Local file SCP** | Dev/testing, quick iteration |
+| **OpenWrt SDK** | Building proper .ipk/.apk with dependency metadata |
+| **Image Builder / ASU** | Production firmware, survives factory reset |
+
+Key details to document:
+- OpenWrt 25.12+ uses `apk` (not `opkg`); older uses `opkg`
+- `apk add --allow-untrusted` required for unsigned local packages
+- `opkg install /tmp/pkg.ipk` for opkg-based systems
+- SDK build: `make package/luci-app-zt-gateway/compile V=s`
+- ASU: `luci-app-attendedsysupgrade` → Advanced Mode → add package
+- Prerequisites: `luci-base`, `ucode`, `rpcd-mod-ucode`, `luci-compat`
+- Custom feed: `src/gz` in `/etc/opkg/customfeeds.conf` or apk equivalent
+
+## 2. `mise.toml` — add `deploy:install` task
+
+Following snowbud patterns: env var params, usage validation, step-by-step echo output.
+
+### Task design
+
+```toml
+[tasks."deploy:install"]
+description = "SCP app files to an OpenWrt device and install"
+```
+
+**Parameters** (via env vars):
+- `HOST` — SSH target, default `root@192.168.15.1`
+
+**What it does:**
+1. Validate `ssh` connectivity to `$HOST`
+2. SCP each file from `root/` to its corresponding remote path (stripping the leading `root` prefix)
+3. SCP `htdocs/luci-static/resources/view/zt-gateway/overview.js` → `/www/luci-static/resources/view/zt-gateway/overview.js`
+4. `chmod +x` the `zt-gateway-switch` script on the remote
+5. Restart `rpcd` and `uhttpd` so LuCI picks up changes
+6. Echo the URL to open
+
+### File mapping (local → remote)
+
+| Local | Remote |
+|---|---|
+| `root/usr/sbin/zt-gateway-switch` | `/usr/sbin/zt-gateway-switch` |
+| `root/usr/share/rpcd/ucode/zt-gateway.uc` | `/usr/share/rpcd/ucode/zt-gateway.uc` |
+| `root/usr/share/rpcd/ucode/system.uc` | `/usr/share/rpcd/ucode/system.uc` |
+| `root/usr/share/ucode/luci/runtime.uc` | `/usr/share/ucode/luci/runtime.uc` |
+| `root/usr/share/luci/menu.d/luci-app-zt-gateway.json` | `/usr/share/luci/menu.d/luci-app-zt-gateway.json` |
+| `root/usr/share/rpcd/acl.d/luci-app-zt-gateway.json` | `/usr/share/rpcd/acl.d/luci-app-zt-gateway.json` |
+| `root/etc/config/zt-gateway` | `/etc/config/zt-gateway` |
+| `htdocs/.../overview.js` | `/www/.../overview.js` |
+
+## Files to modify
+
+| File | Action |
+|---|---|
+| `docs/INSTALL.md` | **Create** |
+| `mise.toml` | **Edit** — append `deploy:install` task |
+
+## Verification
+
+1. `mise tasks` should list the new `deploy:install` task
+2. `docs/INSTALL.md` should be readable and cover all 6 methods