feat: +thin-client role + AZ-TC-01..03 pilot

Auf Basis des Grilling-Sessions mit 20 design decisions umgesetztes
v1-Skeleton der Thin-Client-Rolle plus 3 Pilot-Hosts.

Architektur:
- roles/thin-client/ als geschlossene Rolle (default.nix compose + 7
  Subdirectories: hardware, session, identity, network, peripherals,
  apps, monitoring, deployment)
- hosts/AZ-TC-NN/default.nix als ~20-Zeilen-Wrapper pro Fleet-Host
- flake.nix instanziiert AZ-TC-01..03 via Fleet-Helper
- secrets.nix mit per-host agenix-Secret-Stubs

Submodule:
- hardware: dell-optiplex-micro + generic-x86_64-uefi Fallback
- identity: AD (sssd/krb5/keytab via agenix), lokale Notfalluser
  (sascha.koenig + jannik.mueller ohne m3ta-home), sudo-Policy
- session: KDE Plasma 6 + Wayland + SDDM, Branding (Wallpaper + Footer),
  PipeWire Audio
- network: NetworkManager + wpa_supplicant + 802.1X EAP-TLS, NetBird
  + SSH via NetBird, systemd-resolved (Corp + NetBird DNS), hardened
  firewall, OpenSSH
- peripherals: CUPS mit Pull-Print-Queue, pam_mount für DFS-Shares
- apps: Chromium (ManagedBookmarks, Bitwarden force-install, no local
  passwords), Office-Web .desktop-Shortcuts, Remmina (mehrere TS,
  Kerberos SSO), RustDesk Client + Daemon, OBS Studio, Autostart
- monitoring: node_exporter → Pushgateway, Alloy (stub für Loki),
  Snipe-IT Asset-Checkin (stub)
- deployment: Disko BTRFS-Layout, auto-upgrade daily + reboot window,
  snapper snapshots

Build-Validierung: 'nix flake check' bestanden für AZ-TC-01/02/03.

Siehe roles/thin-client/README.md für den Provisionierungs-Workflow
und die Liste der noch auszufüllenden Platzhalter (TODO-Kommentare
in den jeweiligen Modulen).

roles/thin-client/apps/remmina.nix

@@ -0,0 +1,96 @@
+# roles/thin-client/apps/remmina.nix
+#
+# Remmina RDP client with system-wide connection profiles.
+# Q10 decisions: System-wide /etc/remmina/, Kerberos SSO, several TS,
+# Fullscreen+Multi-Monitor, only Audio local redirection.
+#
+# Note on "Several TS": we ship a small placeholder list with one example.
+# Add real TS endpoints in az.tc.rdp.servers below.
+{config, lib, pkgs, ...}: let
+  inherit (lib) mkIf mkOption types;
+  cfg = config.az.tc;
+
+  # Helper: builds a .remmina profile for one TS
+  mkRemminaProfile = server: let
+    name = server.name;
+    fqdn = server.fqdn;
+  in
+    pkgs.writeTextFile {
+      name = "${lib.toLower name}.remmina";
+      destination = "/etc/remmina/${lib.toLower name}.remmina";
+      text = ''
+        [remmina]
+        name=${name}
+        protocol=RDP
+        server=${fqdn}
+        username=
+        domain=AZ-GROUP
+        security=
+        colordepth=32
+        resolution=multimonitor
+        viewmode=2
+        fullscreen=1
+        multimon=1
+        audio-mode=1
+        audiocapture=0
+        clipboard=both
+        quality=2
+        kerberos=1
+        enable-authecol=kerberos
+        disableclipboard=0
+        redirectsound=1
+        redirectprinter=0
+        redirectdrive=0
+        redirectusb=0
+        keyboard-grab=1
+        showcursor=1
+      '';
+    };
+in {
+  options.az.tc.rdp = {
+    servers = mkOption {
+      type = types.listOf (types.submodule {
+        options = {
+          name = mkOption {
+            type = types.str;
+            description = "Display name (e.g. 'TS Berlin', 'TS ERP').";
+          };
+          fqdn = mkOption {
+            type = types.str;
+            description = "FQDN of the TS endpoint (e.g. 'ts-berlin.az-group.local').";
+          };
+        };
+      });
+      default = [
+        # TODO: fill real TS endpoints
+        {
+          name = "TS Berlin";
+          fqdn = "ts-berlin.az-group.local";
+        }
+      ];
+      description = ''
+        List of Terminal Server endpoints. One Remmina profile per entry
+        is generated system-wide.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      remmina
+      freerdp3
+    ];
+
+    # System-wide Remmina profiles
+    environment.etc = builtins.listToAttrs (builtins.map (server: {
+        name = "remmina/${lib.toLower server.name}.remmina";
+        value.source = (mkRemminaProfile server) + "/etc/remmina/${lib.toLower server.name}.remmina";
+      })
+      config.az.tc.rdp.servers);
+
+    # Allow Domain Users to read the system-wide profiles
+    systemd.tmpfiles.rules = [
+      "d /etc/remmina 0755 root root -"
+    ];
+  };
+}