feat: +thin-client role + AZ-TC-01..03 pilot

Auf Basis des Grilling-Sessions mit 20 design decisions umgesetztes
v1-Skeleton der Thin-Client-Rolle plus 3 Pilot-Hosts.

Architektur:
- roles/thin-client/ als geschlossene Rolle (default.nix compose + 7
  Subdirectories: hardware, session, identity, network, peripherals,
  apps, monitoring, deployment)
- hosts/AZ-TC-NN/default.nix als ~20-Zeilen-Wrapper pro Fleet-Host
- flake.nix instanziiert AZ-TC-01..03 via Fleet-Helper
- secrets.nix mit per-host agenix-Secret-Stubs

Submodule:
- hardware: dell-optiplex-micro + generic-x86_64-uefi Fallback
- identity: AD (sssd/krb5/keytab via agenix), lokale Notfalluser
  (sascha.koenig + jannik.mueller ohne m3ta-home), sudo-Policy
- session: KDE Plasma 6 + Wayland + SDDM, Branding (Wallpaper + Footer),
  PipeWire Audio
- network: NetworkManager + wpa_supplicant + 802.1X EAP-TLS, NetBird
  + SSH via NetBird, systemd-resolved (Corp + NetBird DNS), hardened
  firewall, OpenSSH
- peripherals: CUPS mit Pull-Print-Queue, pam_mount für DFS-Shares
- apps: Chromium (ManagedBookmarks, Bitwarden force-install, no local
  passwords), Office-Web .desktop-Shortcuts, Remmina (mehrere TS,
  Kerberos SSO), RustDesk Client + Daemon, OBS Studio, Autostart
- monitoring: node_exporter → Pushgateway, Alloy (stub für Loki),
  Snipe-IT Asset-Checkin (stub)
- deployment: Disko BTRFS-Layout, auto-upgrade daily + reboot window,
  snapper snapshots

Build-Validierung: 'nix flake check' bestanden für AZ-TC-01/02/03.

Siehe roles/thin-client/README.md für den Provisionierungs-Workflow
und die Liste der noch auszufüllenden Platzhalter (TODO-Kommentare
in den jeweiligen Modulen).

roles/thin-client/apps/rustdesk.nix

@@ -0,0 +1,82 @@
+# roles/thin-client/apps/rustdesk.nix
+#
+# RustDesk client (Hilfe annehmen) + daemon (unattended support).
+# Q13 decisions: Beides (Client+Daemon), Self-hosted Server, Pre-Shared Key
+# via agenix, Wayland portal pre-authorized, Permanent password via agenix.
+{config, lib, pkgs, ...}: let
+  inherit (lib) mkIf mkOption types;
+  cfg = config.az.tc;
+  hostname = config.networking.hostName;
+in {
+  options.az.tc.rustdesk = {
+    serverHost = mkOption {
+      type = types.str;
+      default = "rustdesk.az-group.local"; # TODO: real host
+      description = "Self-hosted RustDesk hbbs/hbbr endpoint (via NetBird).";
+    };
+
+    serverPort = mkOption {
+      type = types.int;
+      default = 21116;
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment = {
+      systemPackages = with pkgs; [rustdesk];
+
+      etc = {
+        # /etc/rustdesk/RustDesk.toml — daemon config. Pre-shared key and
+        # server endpoints go here. Permanent password is in a separate
+        # agenix secret and written to a path RustDesk reads.
+        "rustdesk/RustDesk.toml".text = ''
+          [options]
+          custom-rendezvous-server = ${config.az.tc.rustdesk.serverHost}
+          relay-server = ${config.az.tc.rustdesk.serverHost}
+          api-server = https://${config.az.tc.rustdesk.serverHost}
+          key = file:/run/agenix/rustdesk-psk
+          verification-method = fixed-password
+          permanent-password-file = /run/agenix/${hostname}-rustdesk-password
+          enable-wayland-screen-share = true
+          allow-auto-disconnect = false
+        '';
+
+        # Wayland portal pre-authorization for RustDesk — KDE-specific
+        # xdg portal config so the "screen capture" prompt is pre-approved.
+        "xdg-desktop-portal/kde-screen-share.conf".text = ''
+          [allowed]
+          rustdesk=true
+        '';
+      };
+    };
+
+    # Systemd service: RustDesk daemon (runs as root for unattended).
+    systemd.services.rustdesk = {
+      description = "RustDesk unattended support daemon";
+      wantedBy = ["multi-user.target"];
+      after = ["network-online.target" "age-identity.service"];
+      wants = ["network-online.target" "age-identity.service"];
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = "${pkgs.rustdesk}/bin/rustdesk --service";
+        Restart = "always";
+        RestartSec = "5s";
+        User = "root";
+      };
+    };
+
+    # Shared pre-shared key (one for all thin clients)
+    age.secrets."rustdesk-psk" = {
+      file = ../../secrets/rustdesk-psk.age;
+      mode = "0400";
+      owner = "root";
+    };
+
+    # Per-host permanent password
+    age.secrets."${hostname}-rustdesk-password" = {
+      file = ../../secrets/${hostname}-rustdesk-password.age;
+      mode = "0400";
+      owner = "root";
+    };
+  };
+}