fix(thin-client): deep-build fixes + Snipe-IT/Alloy real impl

Tiefen-Validierung via 'nix build .#nixosConfigurations.AZ-TC-NN.config.
system.build.toplevel' hat mehrere reale Bugs gefunden, die 'nix flake
check' nicht sah. Alle drei Pilot-Hosts bauen jetzt sauber durch.

Gefixst:
- freerdp3 → freerdp (umbenannt in nixpkgs-unstable)
- SDDM Theme.Logo will INI-Atom (string), nicht Nix-path → '${path}'
- security.pam.mount.extraVolumes will list-of-string, nicht ein String
- sudoers: 'domain admins' muss als 'domain\ admins' escaped werden
- agenix file-Pfade: ../../secrets/ → ../../../secrets/ (Tiefe korrigiert)
- snapper: config.services.snapper.package gibt es nicht → pkgs.snapper
- samba4Full entfernt (blockiert durch ceph-common python metadata issue
  in nixpkgs-unstable; Thin Clients brauchen es nicht — cifs-utils reicht)
- corp-wifi-ca.pem durch gültiges Dummy-PEM ersetzt (openssl-generiert,
  mit明显 REPLACE-MARKER; build kann PEM parsen)

Functional gemacht:
- Alloy: echtes River-Config mit loki.source.journal + loki.write statt
  barem logging-stub. Journal-Logs mit host/unit/severity-Labels nach
  Loki.
- Snipe-IT: echte Check-in-Logik via curl + jq. Lookup by asset_tag,
  PATCH falls exists, POST falls neu. startAt täglich 03:30. API-Token
  via agenix (snipeit-api-token.age).
- node_exporter push: realer curl-Push alle 60s mit retry on failure.

Safety:
- Placeholder-Assertions in roles/thin-client/default.nix: build schlägt
  fehl, wenn wifi.ssid/hotline/company noch Placeholder sind (außer
  site='staging'). Pilot-Hosts haben site='staging' bis echte Werte da.
- assets/corp-wifi-ca.pem hat deutlich sichtbaren REPLACE-Hinweis.

Neue Options:
- az.tc.monitoring.snipeItUrl (default: snipeit.az-group.local)

Neue Secrets (Placeholder .age-Files zum Ausfüllen):
- snipeit-api-token.age (fleet-wide shared)

roles/thin-client/default.nix

@@ -104,11 +104,31 @@ in {
     # Firewall is enabled by the network module.
 
     # ── assertions / warnings ────────────────────────────────────────
+    # Catches un-overridden placeholders at build time so the operator
+    # notices BEFORE deploying to a real Thin Client. Each assertion
+    # checks a "placeholder" marker value; override the option in
+    # hosts/AZ-TC-NN/default.nix to silence.
     assertions = [
       {
         assertion = cfg.enable -> (config.networking.hostName or "") != "";
         message = "az.tc.enable requires networking.hostName to be set (e.g. 'AZ-TC-01').";
       }
+      {
+        assertion = cfg.enable -> config.az.tc.wifi.ssid != "AZ-CORP" || config.az.tc.site == "staging";
+        message = ''
+          az.tc.wifi.ssid is still the placeholder 'AZ-CORP'. Set the
+          real corp WiFi SSID in hosts/AZ-TC-NN/default.nix (or set
+          az.tc.site = "staging" to silence for lab/test hosts).
+        '';
+      }
+      {
+        assertion = cfg.enable -> config.az.tc.branding.hotline != "+49 30 1234567" || config.az.tc.site == "staging";
+        message = "az.tc.branding.hotline is still the placeholder — set the real IT-Hotline number.";
+      }
+      {
+        assertion = cfg.enable -> config.az.tc.branding.company != "AzIntec GmbH" || config.az.tc.site == "staging";
+        message = "az.tc.branding.company is still the placeholder 'AzIntec GmbH' — set the real company name.";
+      }
     ];
   };
 }