feat: +thin-client role + AZ-TC-01..03 pilot

Auf Basis des Grilling-Sessions mit 20 design decisions umgesetztes
v1-Skeleton der Thin-Client-Rolle plus 3 Pilot-Hosts.

Architektur:
- roles/thin-client/ als geschlossene Rolle (default.nix compose + 7
  Subdirectories: hardware, session, identity, network, peripherals,
  apps, monitoring, deployment)
- hosts/AZ-TC-NN/default.nix als ~20-Zeilen-Wrapper pro Fleet-Host
- flake.nix instanziiert AZ-TC-01..03 via Fleet-Helper
- secrets.nix mit per-host agenix-Secret-Stubs

Submodule:
- hardware: dell-optiplex-micro + generic-x86_64-uefi Fallback
- identity: AD (sssd/krb5/keytab via agenix), lokale Notfalluser
  (sascha.koenig + jannik.mueller ohne m3ta-home), sudo-Policy
- session: KDE Plasma 6 + Wayland + SDDM, Branding (Wallpaper + Footer),
  PipeWire Audio
- network: NetworkManager + wpa_supplicant + 802.1X EAP-TLS, NetBird
  + SSH via NetBird, systemd-resolved (Corp + NetBird DNS), hardened
  firewall, OpenSSH
- peripherals: CUPS mit Pull-Print-Queue, pam_mount für DFS-Shares
- apps: Chromium (ManagedBookmarks, Bitwarden force-install, no local
  passwords), Office-Web .desktop-Shortcuts, Remmina (mehrere TS,
  Kerberos SSO), RustDesk Client + Daemon, OBS Studio, Autostart
- monitoring: node_exporter → Pushgateway, Alloy (stub für Loki),
  Snipe-IT Asset-Checkin (stub)
- deployment: Disko BTRFS-Layout, auto-upgrade daily + reboot window,
  snapper snapshots

Build-Validierung: 'nix flake check' bestanden für AZ-TC-01/02/03.

Siehe roles/thin-client/README.md für den Provisionierungs-Workflow
und die Liste der noch auszufüllenden Platzhalter (TODO-Kommentare
in den jeweiligen Modulen).

flake.nix

@@ -54,6 +54,7 @@
   outputs = {
     self,
     agenix,
+    disko,
     nixpkgs,
     m3ta-nixpkgs,
     ...
@@ -107,6 +108,37 @@
           m3ta-nixpkgs.nixosModules.default
         ];
       };
+
+      # ── Thin Client fleet (AZ-TC-NN) ──────────────────────────────
+      # Each host is a minimal wrapper around the thin-client role.
+      # Add new hosts by:
+      #   1. Create hosts/AZ-TC-NN/default.nix (copy from AZ-TC-01).
+      #   2. Add an entry here.
+      #   3. Run `agenix -e secrets/AZ-TC-NN-*.age` to provision secrets.
+      AZ-TC-01 = inputs.nixpkgs.lib.nixosSystem {
+        specialArgs = {inherit inputs outputs; system = "x86_64-linux";};
+        modules = [
+          disko.nixosModules.disko
+          agenix.nixosModules.default
+          ./hosts/AZ-TC-01
+        ];
+      };
+      AZ-TC-02 = inputs.nixpkgs.lib.nixosSystem {
+        specialArgs = {inherit inputs outputs; system = "x86_64-linux";};
+        modules = [
+          disko.nixosModules.disko
+          agenix.nixosModules.default
+          ./hosts/AZ-TC-02
+        ];
+      };
+      AZ-TC-03 = inputs.nixpkgs.lib.nixosSystem {
+        specialArgs = {inherit inputs outputs; system = "x86_64-linux";};
+        modules = [
+          disko.nixosModules.disko
+          agenix.nixosModules.default
+          ./hosts/AZ-TC-03
+        ];
+      };
     };
   };
 }