Enable bridging in the kernel config

The vendor 5.10 kernel is built without CONFIG_BRIDGE, and that absence has
shaped the firmware: the panel's access point has to be its own subnet with its
own DHCP pool instead of joining the LAN, and warden_router_set_zone() treats a
second LAN port as impossible. Both carry a code comment saying "this kernel has
no bridge".

Turning it on is what lets a Client-mode panel run an access point the way an
ordinary ceiling AP does -- wlan0 and the wired uplink in one broadcast domain,
addresses handed out by whatever router is already upstream.

Verified on the bench panel: before, `ip link add type bridge` returned
"Operation not supported"; on this kernel the bridge is created and eth0
enslaves into it (/sys/class/net/br0/brif/eth0). WireGuard, iptables and VLAN
still work.

Also fixes a warden-modbus path in architecture.md left stale by the apps/ move.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T2D2KtdgwbhbF6Mo64eUrn

build/warden_defconfig

@@ -1324,6 +1324,16 @@ CONFIG_WIREGUARD=y
 CONFIG_NET_UDP_TUNNEL=y
 # VLAN: the MikroTik app configures tagged ports and the panel terminates them.
 CONFIG_VLAN_8021Q=y
+# Bridging. Not in the vendor kernel, and its absence is why the panel's access
+# point has to be its own subnet with its own DHCP pool rather than joining the
+# LAN's broadcast domain (see the comment in ui-src/src/warden/router.c). With a
+# bridge the panel can run an AP the way a UniFi AP does: wlan0 and the LAN port
+# in one broadcast domain, addresses handed out by whatever router is already
+# upstream. That is a capability this kernel adds, not one it restores.
+CONFIG_BRIDGE=y
+CONFIG_BRIDGE_IGMP_SNOOPING=y
+CONFIG_LLC=y
+CONFIG_STP=y
 # Netfilter: S35iptables and router mode. Scoped to what the scripts actually
 # use -- filter + nat tables, MASQUERADE, and the state/limit matches -- rather
 # than the vendor kernel's full 124-symbol suite.