setup wizard: fix routing, DHCP, WiFi AP, firewall, and deploy task

Setup script fixes:
- _cidr_to_mask: pad to 4 octets (/24 -> 255.255.255.0)
- UCI quoting: remove embedded shell quotes from uci set calls
- Bridge ports: auto-detect zt* interface instead of hardcoding ztabc0
- Bridge netmask: default to /23 (255.255.254.0) for ZT+WIBLAN
- DHCP/WiFi AP: reference interface name (zt_wiblan) not device name (br_zt)
- Firewall zone: add zt_wiblan to LAN zone for nftables fw4
- ZT IP persistence: ensure ZT-assigned IP stays on interface for ARP
- Exit gateway routing: table 100/101 route via exit gateway, not self
- New setup-wifi-ap subcommand for WIBLAN WiFi AP

UBUS handler:
- Add setup-wifi-ap to validation regex and error message

Deploy task:
- Auto-discover files from root/ and htdocs/ instead of hardcoded list
- Clear LuCI cache before restarting services

Documentation:
- New docs/SETUP-GATEWAY.md with architecture, config, pitfalls, checklist
- Updated docs/INSTALL.md with deploy task and setup wizard sections
- Updated docs/PROGRESS.md with session log and learnings

docs/PROGRESS.md

@@ -95,3 +95,61 @@ After installing `luci-compat`, login and page rendering work correctly, but **f
 4. **Run full suite end-to-end** after the above blocker is resolved.
 5. **Clean up debug scripts**: `debug-pw.js`, `debug-pw2.js`, `debug-pw3.js`, `debug-login-dom.js`.
 6. **Rebuild image properly** once build-time network is restored so `luci-compat` is baked in without manual commits.
+
+## Date: 2026-07-13
+
+## Setup Wizard Implementation
+
+### Completed
+
+1. **Created `/usr/sbin/zt-gateway-setup`** (700+ lines) with subcommands:
+   - `status`, `setup-bridge`, `setup-routing`, `setup-dhcp`, `setup-wifi-ap`,
+     `setup-hotplug`, `setup-persistence`, `setup-all`
+
+2. **Added `setup` ubus method** to `zt-gateway.uc` with regex validation
+   (ucode lacks `Array.indexOf()`).
+
+3. **Added Setup panel** to `overview.js` with buttons for each setup command.
+
+4. **Auto-discover deploy task** — `deploy:install` now discovers files from
+   `root/` and `htdocs/` instead of listing them individually.
+
+### Bugs Found and Fixed During Setup
+
+1. **`_cidr_to_mask` produced 3 octets** for /24 (`255.255.255` instead of
+   `255.255.255.0`). Fixed by padding to 4 octets.
+
+2. **UCI values had embedded quotes** — `uci set "proto='static'"` stored
+   `'static'` instead of `static`. Fixed by removing shell quotes.
+
+3. **Bridge ports hardcoded to `ztabc0`** — ZeroTier interface names are
+   randomized. Fixed by auto-detecting `zt*` interfaces.
+
+4. **DHCP/WiFi AP referenced device name instead of interface name** — dnsmasq
+   and hostapd bind to interfaces, not devices. Fixed to use `zt_wiblan`.
+
+5. **Firewall zone missing** — nftables fw4 has `policy drop`. Fixed by adding
+   `zt_wiblan` to the LAN zone.
+
+6. **ZT interface lost IP when added to bridge** — ARP responses failed. Fixed
+   by ensuring ZT-assigned IP stays on the interface.
+
+7. **Table 100 routed to self** — Default route pointed to `WIBLAN_GW` (local)
+   instead of exit gateway. Fixed by detecting exit gateway from UCI/routes.
+
+8. **Bridge netmask /24 instead of /23** — Couldn't reach ZT subnet. Fixed by
+   defaulting to `/23` (255.255.254.0).
+
+9. **ZeroTier Ethernet Bridging disabled** — L2 frames couldn't traverse
+   tunnel. Fixed by enabling in ZT network controller.
+
+10. **DHCP range wrong in /23** — Clients got `10.11.12.x` instead of
+    `10.11.13.x`. Fixed by calculating correct offset (356 for /23 base).
+
+### Key Learnings
+
+- OpenWrt UCI uses **interface names** (not device names) for DHCP and WiFi
+- Bridge netmask must be `/23` to cover both ZT (10.11.12.x) and WIBLAN (10.11.13.x)
+- ZeroTier requires "Allow Ethernet Bridging" for L2 traffic
+- nftables fw4 zones must explicitly include bridge interfaces
+- Policy routing table 100 must route via exit gateway, not local IP