fix(openwrt): capture apk stderr and run apk update before apk add opkg

apk errors were being silently dropped (stdout only). Run apk update
first and fail with a clear "router may have no internet" message if
it fails, rather than a cryptic exit-1 from apk add.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

core/archipelago/src/api/rpc/middleware.rs

@@ -70,6 +70,7 @@ pub(super) fn sanitize_error_message(msg: &str) -> String {
         "TollGate installation failed",
         "No pre-built TollGate",
         "opkg not found",
+        "apk update failed",
     ];
     for prefix in &user_facing_prefixes {
         if msg.starts_with(prefix) {

core/openwrt/src/opkg.rs

@@ -15,7 +15,17 @@ impl Router {
         let (_, apk_code) = self.run("test -x /usr/bin/apk")?;
         if apk_code == 0 {
             info!("[{}] opkg not found, bootstrapping via apk", self.host);
-            self.run_ok("/usr/bin/apk add opkg")?;
+            // Capture stderr so apk errors are visible in server logs.
+            let (update_out, update_code) = self.run("/usr/bin/apk update 2>&1")?;
+            if update_code != 0 {
+                anyhow::bail!(
+                    "apk update failed (exit {}) — router may have no internet access. \
+                     Ensure WAN/internet is working on the router before provisioning.\n{}",
+                    update_code,
+                    update_out.trim()
+                );
+            }
+            self.run_ok("/usr/bin/apk add opkg 2>&1")?;
             return Ok(());
         }
         anyhow::bail!(