feat: +thin-client role + AZ-TC-01..03 pilot

Auf Basis des Grilling-Sessions mit 20 design decisions umgesetztes
v1-Skeleton der Thin-Client-Rolle plus 3 Pilot-Hosts.

Architektur:
- roles/thin-client/ als geschlossene Rolle (default.nix compose + 7
  Subdirectories: hardware, session, identity, network, peripherals,
  apps, monitoring, deployment)
- hosts/AZ-TC-NN/default.nix als ~20-Zeilen-Wrapper pro Fleet-Host
- flake.nix instanziiert AZ-TC-01..03 via Fleet-Helper
- secrets.nix mit per-host agenix-Secret-Stubs

Submodule:
- hardware: dell-optiplex-micro + generic-x86_64-uefi Fallback
- identity: AD (sssd/krb5/keytab via agenix), lokale Notfalluser
  (sascha.koenig + jannik.mueller ohne m3ta-home), sudo-Policy
- session: KDE Plasma 6 + Wayland + SDDM, Branding (Wallpaper + Footer),
  PipeWire Audio
- network: NetworkManager + wpa_supplicant + 802.1X EAP-TLS, NetBird
  + SSH via NetBird, systemd-resolved (Corp + NetBird DNS), hardened
  firewall, OpenSSH
- peripherals: CUPS mit Pull-Print-Queue, pam_mount für DFS-Shares
- apps: Chromium (ManagedBookmarks, Bitwarden force-install, no local
  passwords), Office-Web .desktop-Shortcuts, Remmina (mehrere TS,
  Kerberos SSO), RustDesk Client + Daemon, OBS Studio, Autostart
- monitoring: node_exporter → Pushgateway, Alloy (stub für Loki),
  Snipe-IT Asset-Checkin (stub)
- deployment: Disko BTRFS-Layout, auto-upgrade daily + reboot window,
  snapper snapshots

Build-Validierung: 'nix flake check' bestanden für AZ-TC-01/02/03.

Siehe roles/thin-client/README.md für den Provisionierungs-Workflow
und die Liste der noch auszufüllenden Platzhalter (TODO-Kommentare
in den jeweiligen Modulen).

roles/thin-client/apps/obs.nix

@@ -0,0 +1,85 @@
+# roles/thin-client/apps/obs.nix
+#
+# OBS Studio for Schulungs-Recording. Pre-configured profile with
+# PipeWire screen capture + Mic + System-Audio, Output to ~/Videos/OBS/.
+# Q14 decisions: Use Case Schulungs-Recording, Pre-configuriertes Profil,
+# Output local, no streaming.
+{config, lib, pkgs, ...}: let
+  inherit (lib) mkIf;
+  cfg = config.az.tc;
+in {
+  config = mkIf cfg.enable {
+    environment = {
+      systemPackages = with pkgs; [
+        obs-studio
+        obs-studio-plugins.obs-pipewire-audio-capture
+        obs-studio-plugins.wlrobs
+      ];
+
+      etc = {
+        # System-wide OBS profile "AZ-Default".
+        # Installed to /etc/obs/az-default/ and copied to user profile on
+        # first run.
+        "obs/az-default/basic.ini".text = ''
+          [General]
+          Name=AZ-Default
+
+          [Output]
+          Mode=Simple
+          FilenameFormatting=%CCYY-%MM-%DD %hh-%mm-%ss
+          DelayEnable=false
+          DelaySec=20
+          DelayPreserve=false
+          ReplayWhileRecording=false
+          ReplayBufferEnable=false
+
+          [SimpleOutput]
+          FilePath=/home/%/Videos/OBS/
+          RecFormat=mp4
+          VEncoder=x264
+          VBitrate=6000
+          AEncoder=aac
+          ABitrate=192
+
+          [Audio]
+          SampleRate=48000
+          ChannelSetup=stereo
+
+          [Video]
+          Base=1920x1080
+          Output=1920x1080
+          FPSType=0
+          FPSCommon=30
+
+          [AdvOut]
+          ApplyServiceSettings=true
+          RescaleRes=1920x1080
+        '';
+
+        # Pre-configured scene collection with PipeWire screen capture.
+        "obs/az-default/scenes.json".text = ''
+          {
+            "sources": [
+              {
+                "name": "Bildschirm (PipeWire)",
+                "id": "pipewire-screen-capture-source",
+                "type": "input"
+              },
+              {
+                "name": "Mikrofon",
+                "id": "pulse_input_capture",
+                "type": "input"
+              },
+              {
+                "name": "System-Audio",
+                "id": "pulse_output_capture",
+                "type": "input"
+              }
+            ],
+            "scene": "AZ-Default"
+          }
+        '';
+      };
+    };
+  };
+}