fix(thin-client): deep-build fixes + Snipe-IT/Alloy real impl

Tiefen-Validierung via 'nix build .#nixosConfigurations.AZ-TC-NN.config.
system.build.toplevel' hat mehrere reale Bugs gefunden, die 'nix flake
check' nicht sah. Alle drei Pilot-Hosts bauen jetzt sauber durch.

Gefixst:
- freerdp3 → freerdp (umbenannt in nixpkgs-unstable)
- SDDM Theme.Logo will INI-Atom (string), nicht Nix-path → '${path}'
- security.pam.mount.extraVolumes will list-of-string, nicht ein String
- sudoers: 'domain admins' muss als 'domain\ admins' escaped werden
- agenix file-Pfade: ../../secrets/ → ../../../secrets/ (Tiefe korrigiert)
- snapper: config.services.snapper.package gibt es nicht → pkgs.snapper
- samba4Full entfernt (blockiert durch ceph-common python metadata issue
  in nixpkgs-unstable; Thin Clients brauchen es nicht — cifs-utils reicht)
- corp-wifi-ca.pem durch gültiges Dummy-PEM ersetzt (openssl-generiert,
  mit明显 REPLACE-MARKER; build kann PEM parsen)

Functional gemacht:
- Alloy: echtes River-Config mit loki.source.journal + loki.write statt
  barem logging-stub. Journal-Logs mit host/unit/severity-Labels nach
  Loki.
- Snipe-IT: echte Check-in-Logik via curl + jq. Lookup by asset_tag,
  PATCH falls exists, POST falls neu. startAt täglich 03:30. API-Token
  via agenix (snipeit-api-token.age).
- node_exporter push: realer curl-Push alle 60s mit retry on failure.

Safety:
- Placeholder-Assertions in roles/thin-client/default.nix: build schlägt
  fehl, wenn wifi.ssid/hotline/company noch Placeholder sind (außer
  site='staging'). Pilot-Hosts haben site='staging' bis echte Werte da.
- assets/corp-wifi-ca.pem hat deutlich sichtbaren REPLACE-Hinweis.

Neue Options:
- az.tc.monitoring.snipeItUrl (default: snipeit.az-group.local)

Neue Secrets (Placeholder .age-Files zum Ausfüllen):
- snipeit-api-token.age (fleet-wide shared)

roles/thin-client/identity/ad.nix

@@ -53,12 +53,16 @@ in {
 
   config = lib.mkIf cfg.enable {
     environment.systemPackages = with pkgs; [
-      adcli
-      sssd
-      samba4Full
-      krb5
-      realmd
-      oddjob
+      adcli # AD computer-account precreate + join helper
+      sssd # AD client daemon
+      krb5 # MIT Kerberos client
+      realmd # DBus service for realm discovery (used by adcli wrapper)
+      # NOTE: samba4Full intentionally NOT included — it would pull in
+      # ceph-common which is currently broken in nixpkgs-unstable
+      # (python metadata issue). Thin Clients don't need Samba server
+      # or smbclient — share mounting uses cifs-utils (in smb-mounts.nix).
+      # If `net` or `smbclient` are ever needed, install on the admin
+      # workstation (AZ-LT-NIX), not on the Thin Client.
     ];
 
     # Kerberos client
@@ -141,7 +145,7 @@ in {
 
     # agenix-deployed machine keytab
     age.secrets."${hostname}-krb5-keytab" = {
-      file = ../../secrets/${hostname}-krb5-keytab.age;
+      file = ../../../secrets/${hostname}-krb5-keytab.age;
       path = "/etc/krb5.keytab";
       mode = "0600";
       owner = "root";

roles/thin-client/identity/sudo.nix

@@ -17,30 +17,18 @@
   cfg = config.az.tc;
 in {
   config = mkIf cfg.enable {
+    # Use extraConfig because sudoers syntax requires escaping the space
+    # in "domain admins" as `\ `. extraRules would not let us inject that.
     security.sudo = {
       enable = true;
       execWheelOnly = true;
-      extraRules = [
-        {
-          groups = ["wheel"];
-          commands = [
-            {
-              command = "ALL";
-              options = ["PASSWD"];
-            }
-          ];
-        }
-        {
-          # SSSD maps "domain admins" via gid; reference by name with escaping.
-          groups = ["domain admins"];
-          commands = [
-            {
-              command = "ALL";
-              options = ["PASSWD"];
-            }
-          ];
-        }
-      ];
+      extraConfig = ''
+        # Domain Admins — sudo WITH password (Q7 decision).
+        # The backslash-space escapes the space in "domain admins".
+        %domain\ admins ALL=(ALL:ALL) PASSWD: ALL
+        Defaults:%domain\ admins env_keep+=TERMINFO_DIRS
+        Defaults:%domain\ admins env_keep+=TERMINFO
+      '';
     };
   };
 }