Enable bridging in the kernel config

The vendor 5.10 kernel is built without CONFIG_BRIDGE, and that absence has
shaped the firmware: the panel's access point has to be its own subnet with its
own DHCP pool instead of joining the LAN, and warden_router_set_zone() treats a
second LAN port as impossible. Both carry a code comment saying "this kernel has
no bridge".

Turning it on is what lets a Client-mode panel run an access point the way an
ordinary ceiling AP does -- wlan0 and the wired uplink in one broadcast domain,
addresses handed out by whatever router is already upstream.

Verified on the bench panel: before, `ip link add type bridge` returned
"Operation not supported"; on this kernel the bridge is created and eth0
enslaves into it (/sys/class/net/br0/brif/eth0). WireGuard, iptables and VLAN
still work.

Also fixes a warden-modbus path in architecture.md left stale by the apps/ move.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T2D2KtdgwbhbF6Mo64eUrn

build/warden_defconfig

@@ -1324,6 +1324,16 @@ CONFIG_WIREGUARD=y
 CONFIG_NET_UDP_TUNNEL=y
 # VLAN: the MikroTik app configures tagged ports and the panel terminates them.
 CONFIG_VLAN_8021Q=y
+# Bridging. Not in the vendor kernel, and its absence is why the panel's access
+# point has to be its own subnet with its own DHCP pool rather than joining the
+# LAN's broadcast domain (see the comment in ui-src/src/warden/router.c). With a
+# bridge the panel can run an AP the way a UniFi AP does: wlan0 and the LAN port
+# in one broadcast domain, addresses handed out by whatever router is already
+# upstream. That is a capability this kernel adds, not one it restores.
+CONFIG_BRIDGE=y
+CONFIG_BRIDGE_IGMP_SNOOPING=y
+CONFIG_LLC=y
+CONFIG_STP=y
 # Netfilter: S35iptables and router mode. Scoped to what the scripts actually
 # use -- filter + nat tables, MASQUERADE, and the state/limit matches -- rather
 # than the vendor kernel's full 124-symbol suite.

docs/architecture.md

@@ -17,7 +17,7 @@ tested (or not) differently. Today:
 | HPMCU / RISC-V coproc | `flared/src/hpmcu.rs` | via devmem + firmware blob load | `WARDEN_HPMCU_FW` redirects the blob path only | env gate disables it |
 | NPU load | `ui-src/.../sysmon.c` | read `/proc/rknpu/load` | **none**, literal path | file absent -> "NPU absent" |
 | RGA (2D blit) | `ui-src/.../warden_rga.c` | `librga improcess` + dma-heap ioctl | compile-time `#if WARDEN_USE_RGA` | `#if` off -> LVGL software path |
-| RS485 daemon | `warden-modbus/modbus_engine.c` | `open("/dev/ttyS4")` | recompile `-DRS485_PORT=<pty>` | (recompiled for a pty) |
+| RS485 daemon | `apps/warden-modbus/modbus_engine.c` | `open("/dev/ttyS4")` | recompile `-DRS485_PORT=<pty>` | (recompiled for a pty) |
 | RS485 panel client | `ui-src/.../modbus.c` | `AF_UNIX` socket | `WARDEN_MODBUS_SOCK` env override | socket absent -> "unavailable" |
 | Relays / GPIO | `ui-src/.../relays.c` | `/sys/class/gpio` sysfs | **none**, literal paths | path absent -> "unavailable" |
 | Slot metadata | `flared/src/slotctl.rs` | `misc` partition + `/proc/cmdline` | `WARDEN_MISC_DEV`, `WARDEN_CMDLINE_FILE` env overrides | (redirected to scratch files) |