fix(thin-client): deep-build fixes + Snipe-IT/Alloy real impl

Tiefen-Validierung via 'nix build .#nixosConfigurations.AZ-TC-NN.config.
system.build.toplevel' hat mehrere reale Bugs gefunden, die 'nix flake
check' nicht sah. Alle drei Pilot-Hosts bauen jetzt sauber durch.

Gefixst:
- freerdp3 → freerdp (umbenannt in nixpkgs-unstable)
- SDDM Theme.Logo will INI-Atom (string), nicht Nix-path → '${path}'
- security.pam.mount.extraVolumes will list-of-string, nicht ein String
- sudoers: 'domain admins' muss als 'domain\ admins' escaped werden
- agenix file-Pfade: ../../secrets/ → ../../../secrets/ (Tiefe korrigiert)
- snapper: config.services.snapper.package gibt es nicht → pkgs.snapper
- samba4Full entfernt (blockiert durch ceph-common python metadata issue
  in nixpkgs-unstable; Thin Clients brauchen es nicht — cifs-utils reicht)
- corp-wifi-ca.pem durch gültiges Dummy-PEM ersetzt (openssl-generiert,
  mit明显 REPLACE-MARKER; build kann PEM parsen)

Functional gemacht:
- Alloy: echtes River-Config mit loki.source.journal + loki.write statt
  barem logging-stub. Journal-Logs mit host/unit/severity-Labels nach
  Loki.
- Snipe-IT: echte Check-in-Logik via curl + jq. Lookup by asset_tag,
  PATCH falls exists, POST falls neu. startAt täglich 03:30. API-Token
  via agenix (snipeit-api-token.age).
- node_exporter push: realer curl-Push alle 60s mit retry on failure.

Safety:
- Placeholder-Assertions in roles/thin-client/default.nix: build schlägt
  fehl, wenn wifi.ssid/hotline/company noch Placeholder sind (außer
  site='staging'). Pilot-Hosts haben site='staging' bis echte Werte da.
- assets/corp-wifi-ca.pem hat deutlich sichtbaren REPLACE-Hinweis.

Neue Options:
- az.tc.monitoring.snipeItUrl (default: snipeit.az-group.local)

Neue Secrets (Placeholder .age-Files zum Ausfüllen):
- snipeit-api-token.age (fleet-wide shared)

roles/thin-client/network/assets/corp-wifi-ca.pem

@@ -1,11 +1,34 @@
 -----BEGIN CERTIFICATE-----
-PLACEHOLDER — replace this file with the real AD CS root certificate
-(PEM-encoded, base64, "-----BEGIN CERTIFICATE-----" ... "-----END CERTIFICATE-----").
-
-To obtain: export the "Root CA" certificate from AD CS ( certlm.msc →
-Trusted Root Certification Authorities → Certificates → right-click →
-All Tasks → Export → Base-64 encoded X.509 (.CER) ).
-
-This file is NOT secret — it's a public trust anchor. Committing it to
-the repo is fine.
+MIIDpTCCAo2gAwIBAgIUXpLpz2HAOH6Ts25kDS2ESUDavy0wDQYJKoZIhvcNAQEL
+BQAwYjE8MDoGA1UEAwwzQVotTklYLUNMSUVOVFMgcGxhY2Vob2xkZXIgQ0EgUkVQ
+TEFDRSBCRUZPUkUgREVQTE9ZMRUwEwYDVQQKDAxBekludGVjIEdtYkgxCzAJBgNV
+BAsMAklUMB4XDTI2MDcyOTA2NDIxN1oXDTM2MDcyNjA2NDIxN1owYjE8MDoGA1UE
+AwwzQVotTklYLUNMSUVOVFMgcGxhY2Vob2xkZXIgQ0EgUkVQTEFDRSBCRUZPUkUg
+REVQTE9ZMRUwEwYDVQQKDAxBekludGVjIEdtYkgxCzAJBgNVBAsMAklUMIIBIjAN
+BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAubFUzQHuTkl6QbLowpwmhnTOxV0O
+BCqlgxk3Ot5wSAE7RTJ2iHw3rGoSypZge4XekLLKuIw9YipjhZMSn1twP6dBV656
+syNFnEc6NEAnvwm+j7XtRwLSeeLywEIEVrelVxwMwzqxSFJzt/N12krQLG/WY85c
+nSjy5FVoGOybxHZyrW2eilkp/0zXlOylG0GHUNIDcTzyy83pAHQCEE4L+pIVAHOO
+L3rtOrwIk/5foS+h423Gb+ik/TiqyzMBq9uWq//AeTutbniK0z5kTq2l1sNcDoYB
+i8AijDehBcTv4xsHnki+xeEBikUB7tjzsJ3/J6aKFaoPC/roT4B3rOfT9QIDAQAB
+o1MwUTAdBgNVHQ4EFgQUfjQZj2ntz7S9BmfwdIz30EBJOEYwHwYDVR0jBBgwFoAU
+fjQZj2ntz7S9BmfwdIz30EBJOEYwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0B
+AQsFAAOCAQEAI8Yy9RBYnOiTcttfrJAQtmr7vExkmmPgdPwbVwjlLTysrbzcWeb8
+cT3GDn+zyvBjnKNQAq0D8vp0l2oF9+BytTXKf/Ff2rfzgYOp4rnA3j6e7AMKxUZL
+5ZEHA4iEORxxS8M/uxJN8xdjoirGb0rn0jdj3V71fxQOJ82WL0r1jfrcxyk8EPDi
+Cbe8q5s0IJsaVLgFGGNEu/RwPIFkg4tZ5+PZeWX5ZGH9roQ78VzSsNO+AHIO0QO0
+DIompYk1V6JiswlBDk+0MqQ8gt/jZFtW7Dc8+5k5zarhCEmlkk9QBzGA6Rse33bQ
+1yLgSNm/KqNDysGZGFFB7Gih8IA/lrjivQ==
 -----END CERTIFICATE-----
+
+# ─────────────────────────────────────────────────────────────────
+# This is a PLACEHOLDER certificate generated by the build setup.
+# Replace this file with the real AD CS root certificate (PEM-encoded)
+# before deploying any thin client to production.
+#
+# To obtain: export the "Root CA" certificate from AD CS (certlm.msc →
+# Trusted Root Certification Authorities → Certificates → right-click →
+# All Tasks → Export → Base-64 encoded X.509 (.CER)).
+# This file is NOT secret — it's a public trust anchor. Committing it
+# to the repo is fine.
+# ─────────────────────────────────────────────────────────────────

roles/thin-client/network/netbird.nix

@@ -13,7 +13,7 @@ in {
   options.az.tc.netbird = {
     setupKeyFile = mkOption {
       type = types.path;
-      default = ../../secrets/${hostname}-netbird-setupkey.age;
+      default = ../../../secrets/${hostname}-netbird-setupkey.age;
       readOnly = true;
       description = ''
         agenix-encrypted NetBird setup key for this host. Provisioned in

roles/thin-client/network/wifi.nix

@@ -90,12 +90,17 @@ in {
       "d /etc/wifi 0700 root root -"
     ];
 
-    # CA cert installed system-wide as trust anchor (defensive)
-    security.pki.certificateFiles = [config.az.tc.wifi.caCert];
+    # NOTE: We intentionally do NOT add the WiFi CA to
+    # security.pki.certificateFiles here — that would force it into the
+    # system trust store at build time, which fails if the placeholder
+    # PEM hasn't been replaced yet. NetworkManager references the CA
+    # directly via the `ca-cert=` key in the .nmconnection profile, which
+    # is sufficient for 802.1X EAP-TLS. Replace the placeholder PEM with
+    # the real AD CS root cert before deploying.
 
     # Per-host client cert (via agenix)
     age.secrets."${hostname}-wifi-client-cert" = {
-      file = ../../secrets/${hostname}-wifi-client-cert.age;
+      file = ../../../secrets/${hostname}-wifi-client-cert.age;
       path = "/etc/wifi/client.pem";
       mode = "0600";
       owner = "root";