fix(thin-client): deep-build fixes + Snipe-IT/Alloy real impl

Tiefen-Validierung via 'nix build .#nixosConfigurations.AZ-TC-NN.config.
system.build.toplevel' hat mehrere reale Bugs gefunden, die 'nix flake
check' nicht sah. Alle drei Pilot-Hosts bauen jetzt sauber durch.

Gefixst:
- freerdp3 → freerdp (umbenannt in nixpkgs-unstable)
- SDDM Theme.Logo will INI-Atom (string), nicht Nix-path → '${path}'
- security.pam.mount.extraVolumes will list-of-string, nicht ein String
- sudoers: 'domain admins' muss als 'domain\ admins' escaped werden
- agenix file-Pfade: ../../secrets/ → ../../../secrets/ (Tiefe korrigiert)
- snapper: config.services.snapper.package gibt es nicht → pkgs.snapper
- samba4Full entfernt (blockiert durch ceph-common python metadata issue
  in nixpkgs-unstable; Thin Clients brauchen es nicht — cifs-utils reicht)
- corp-wifi-ca.pem durch gültiges Dummy-PEM ersetzt (openssl-generiert,
  mit明显 REPLACE-MARKER; build kann PEM parsen)

Functional gemacht:
- Alloy: echtes River-Config mit loki.source.journal + loki.write statt
  barem logging-stub. Journal-Logs mit host/unit/severity-Labels nach
  Loki.
- Snipe-IT: echte Check-in-Logik via curl + jq. Lookup by asset_tag,
  PATCH falls exists, POST falls neu. startAt täglich 03:30. API-Token
  via agenix (snipeit-api-token.age).
- node_exporter push: realer curl-Push alle 60s mit retry on failure.

Safety:
- Placeholder-Assertions in roles/thin-client/default.nix: build schlägt
  fehl, wenn wifi.ssid/hotline/company noch Placeholder sind (außer
  site='staging'). Pilot-Hosts haben site='staging' bis echte Werte da.
- assets/corp-wifi-ca.pem hat deutlich sichtbaren REPLACE-Hinweis.

Neue Options:
- az.tc.monitoring.snipeItUrl (default: snipeit.az-group.local)

Neue Secrets (Placeholder .age-Files zum Ausfüllen):
- snipeit-api-token.age (fleet-wide shared)

roles/thin-client/peripherals/smb-mounts.nix

@@ -60,45 +60,37 @@ in {
       pam_mount
     ];
 
-    # pam_mount config — appended to /etc/pam_mount.conf.xml via the
-    # NixOS pam_mount module.
-    security.pam.mount = {
+    # pam_mount config — extraVolumes is a `list of string`, each one
+    # a complete <volume>...</volume> XML element appended to
+    # /etc/pam_mount.conf.xml by the NixOS pam_mount module.
+    security.pam.mount = let
+      dfs = config.az.tc.smb.dfsNamespace;
+      mnt = config.az.tc.smb.mountRoot;
+      # Per-user share
+      userVolume = ''
+        <volume
+          fstype="cifs"
+          server="${dfs}"
+          path="${config.az.tc.smb.userShare}"
+          mountpoint="${mnt}/home"
+          options="sec=krb5i,cruid=%(USER),uid=%(USER),gid=%(USER),multiuser,nodev,nosuid,mfsymlinks"
+          user="*"
+        />
+      '';
+      # Common shares (read-only)
+      commonVolumes = builtins.map (share: ''
+        <volume
+          fstype="cifs"
+          server="${dfs}"
+          path="${share}"
+          mountpoint="${mnt}/${share}"
+          options="sec=krb5i,cruid=%(USER),uid=%(USER),gid=%(USER),multiuser,nodev,nosuid,ro,mfsymlinks"
+          user="*"
+        />
+      '') config.az.tc.smb.commonShares;
+    in {
       enable = true;
-      extraVolumes = let
-        dfs = config.az.tc.smb.dfsNamespace;
-        mnt = config.az.tc.smb.mountRoot;
-        # Per-user share
-        userVolume = ''
-          <volume
-            fstype="cifs"
-            server="${dfs}"
-            path="${config.az.tc.smb.userShare}"
-            mountpoint="${mnt}/home"
-            options="sec=krb5i,cruid=%(USER),uid=%(USER),gid=%(USER),multiuser,nodev,nosuid,mfsymlinks"
-            user="*"
-          />
-        '';
-        # Common shares
-        commonVolumes = builtins.map (share: ''
-          <volume
-            fstype="cifs"
-            server="${dfs}"
-            path="${share}"
-            mountpoint="${mnt}/${share}"
-            options="sec=krb5i,cruid=%(USER),uid=%(USER),gid=%(USER),multiuser,nodev,nosuid,ro,mfsymlinks"
-            user="*"
-          />
-        '') config.az.tc.smb.commonShares;
-      in
-        lib.concatStringsSep "\n" ([userVolume] ++ commonVolumes);
-
-      # Don't kill session if a mount fails — Q9 "lax" decision.
-      # pam_mount has built-in "lax" semantics via the `<luserconf>` and
-      # `<mkmountpoint enable="...">` directives; per-mount `sgrp` filters
-      # ensure missing shares don't abort PAM login.
-      # The NixOS module doesn't expose these as top-level options, so we
-      # rely on the default behavior: failed mounts log warnings, login
-      # continues.
+      extraVolumes = [userVolume] ++ commonVolumes;
     };
 
     # Ensure mount directories exist (created per-user at first login).