feat: +thin-client role + AZ-TC-01..03 pilot

Auf Basis des Grilling-Sessions mit 20 design decisions umgesetztes
v1-Skeleton der Thin-Client-Rolle plus 3 Pilot-Hosts.

Architektur:
- roles/thin-client/ als geschlossene Rolle (default.nix compose + 7
  Subdirectories: hardware, session, identity, network, peripherals,
  apps, monitoring, deployment)
- hosts/AZ-TC-NN/default.nix als ~20-Zeilen-Wrapper pro Fleet-Host
- flake.nix instanziiert AZ-TC-01..03 via Fleet-Helper
- secrets.nix mit per-host agenix-Secret-Stubs

Submodule:
- hardware: dell-optiplex-micro + generic-x86_64-uefi Fallback
- identity: AD (sssd/krb5/keytab via agenix), lokale Notfalluser
  (sascha.koenig + jannik.mueller ohne m3ta-home), sudo-Policy
- session: KDE Plasma 6 + Wayland + SDDM, Branding (Wallpaper + Footer),
  PipeWire Audio
- network: NetworkManager + wpa_supplicant + 802.1X EAP-TLS, NetBird
  + SSH via NetBird, systemd-resolved (Corp + NetBird DNS), hardened
  firewall, OpenSSH
- peripherals: CUPS mit Pull-Print-Queue, pam_mount für DFS-Shares
- apps: Chromium (ManagedBookmarks, Bitwarden force-install, no local
  passwords), Office-Web .desktop-Shortcuts, Remmina (mehrere TS,
  Kerberos SSO), RustDesk Client + Daemon, OBS Studio, Autostart
- monitoring: node_exporter → Pushgateway, Alloy (stub für Loki),
  Snipe-IT Asset-Checkin (stub)
- deployment: Disko BTRFS-Layout, auto-upgrade daily + reboot window,
  snapper snapshots

Build-Validierung: 'nix flake check' bestanden für AZ-TC-01/02/03.

Siehe roles/thin-client/README.md für den Provisionierungs-Workflow
und die Liste der noch auszufüllenden Platzhalter (TODO-Kommentare
in den jeweiligen Modulen).

roles/thin-client/apps/office-web.nix

@@ -0,0 +1,45 @@
+# roles/thin-client/apps/office-web.nix
+#
+# Office 365 (cloud) web apps as Chromium app-mode .desktop files.
+# Q11 decisions: Word, Excel, PowerPoint, Outlook, Teams via
+# `chromium --app=<URL>`, system-wide, Outlook+Teams autostart at login.
+#
+# The .desktop files are installed system-wide via
+# environment.systemPackages, so every user sees them in the KDE menu
+# under "Office".
+{config, lib, pkgs, ...}: let
+  inherit (lib) mkIf;
+  cfg = config.az.tc;
+
+  # Helper: builds a Chromium app-mode .desktop file.
+  mkOfficeWebDesktop = name: url: comment:
+    pkgs.writeTextFile {
+      name = builtins.replaceStrings [" "] ["-"] (lib.toLower name) + ".desktop";
+      destination = "/share/applications/${builtins.replaceStrings [" "] ["-"] (lib.toLower name)}.desktop";
+      text = ''
+        [Desktop Entry]
+        Version=1.0
+        Type=Application
+        Name=${name}
+        GenericName=${name} (Web)
+        Comment=${comment}
+        Exec=${pkgs.chromium}/bin/chromium --app=${url} --no-default-browser-check --no-first-run
+        Icon=web-browser
+        Terminal=false
+        Categories=Office;Network;WebApps;
+        Keywords=office;${lib.toLower name};web;
+        StartupNotify=true
+        StartupWMClass=${url}
+      '';
+    };
+in {
+  config = mkIf cfg.enable {
+    environment.systemPackages = [
+      (mkOfficeWebDesktop "Word" "https://www.office.com/launch/word" "Microsoft Word Online")
+      (mkOfficeWebDesktop "Excel" "https://www.office.com/launch/excel" "Microsoft Excel Online")
+      (mkOfficeWebDesktop "PowerPoint" "https://www.office.com/launch/powerpoint" "Microsoft PowerPoint Online")
+      (mkOfficeWebDesktop "Outlook" "https://outlook.office.com" "Microsoft Outlook Web")
+      (mkOfficeWebDesktop "Teams" "https://teams.microsoft.com" "Microsoft Teams Web")
+    ];
+  };
+}