feat: +thin-client role + AZ-TC-01..03 pilot

Auf Basis des Grilling-Sessions mit 20 design decisions umgesetztes
v1-Skeleton der Thin-Client-Rolle plus 3 Pilot-Hosts.

Architektur:
- roles/thin-client/ als geschlossene Rolle (default.nix compose + 7
  Subdirectories: hardware, session, identity, network, peripherals,
  apps, monitoring, deployment)
- hosts/AZ-TC-NN/default.nix als ~20-Zeilen-Wrapper pro Fleet-Host
- flake.nix instanziiert AZ-TC-01..03 via Fleet-Helper
- secrets.nix mit per-host agenix-Secret-Stubs

Submodule:
- hardware: dell-optiplex-micro + generic-x86_64-uefi Fallback
- identity: AD (sssd/krb5/keytab via agenix), lokale Notfalluser
  (sascha.koenig + jannik.mueller ohne m3ta-home), sudo-Policy
- session: KDE Plasma 6 + Wayland + SDDM, Branding (Wallpaper + Footer),
  PipeWire Audio
- network: NetworkManager + wpa_supplicant + 802.1X EAP-TLS, NetBird
  + SSH via NetBird, systemd-resolved (Corp + NetBird DNS), hardened
  firewall, OpenSSH
- peripherals: CUPS mit Pull-Print-Queue, pam_mount für DFS-Shares
- apps: Chromium (ManagedBookmarks, Bitwarden force-install, no local
  passwords), Office-Web .desktop-Shortcuts, Remmina (mehrere TS,
  Kerberos SSO), RustDesk Client + Daemon, OBS Studio, Autostart
- monitoring: node_exporter → Pushgateway, Alloy (stub für Loki),
  Snipe-IT Asset-Checkin (stub)
- deployment: Disko BTRFS-Layout, auto-upgrade daily + reboot window,
  snapper snapshots

Build-Validierung: 'nix flake check' bestanden für AZ-TC-01/02/03.

Siehe roles/thin-client/README.md für den Provisionierungs-Workflow
und die Liste der noch auszufüllenden Platzhalter (TODO-Kommentare
in den jeweiligen Modulen).

roles/thin-client/deployment/disko.nix

@@ -0,0 +1,94 @@
+# roles/thin-client/deployment/disko.nix
+#
+# BTRFS disk layout via Disko. Used by `nixos-anywhere` during provisioning.
+# Q4 decisions: Standard persistent BTRFS, subvolumes @root and @home,
+# zstd compression, snapper for / (NOT /home — privacy for multi-user).
+#
+# Apply during provisioning:
+#   nixos-anywhere --flake .#AZ-TC-01 \
+#     --disko disko-config ./roles/thin-client/deployment/disko.nix \
+#     root@<target-ip>
+#
+# This module sets `disko.devices` so the config can be referenced both
+# for partitioning (nixos-anywhere --disko) and for fstab generation.
+{config, lib, ...}: let
+  inherit (lib) mkIf mkOption types;
+  cfg = config.az.tc;
+in {
+  options.az.tc.deployment = {
+    diskDevice = mkOption {
+      type = types.str;
+      default = "/dev/sda";
+      description = ''
+        Target disk device for the BTRFS layout. Typically /dev/sda or
+        /dev/nvme0n1. Override per-host in hosts/AZ-TC-NN/default.nix.
+      '';
+    };
+
+    swapSizeGB = mkOption {
+      type = types.int;
+      default = 4;
+      description = "Swap partition size in GB. Set 0 to disable swap.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    disko.devices = {
+      disk.main = {
+        type = "disk";
+        device = config.az.tc.deployment.diskDevice;
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "512M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+                mountOptions = ["umask=0077"];
+              };
+            };
+            swap = mkIf (config.az.tc.deployment.swapSizeGB > 0) {
+              size = "${toString config.az.tc.deployment.swapSizeGB}G";
+              content = {
+                type = "swap";
+                randomEncryption = true;
+              };
+            };
+            root = {
+              size = "100%";
+              content = {
+                type = "btrfs";
+                extraArgs = ["-f"]; # force overwrite
+                subvolumes = {
+                  "@root" = {
+                    mountpoint = "/";
+                    mountOptions = ["compress=zstd" "noatime" "ssd"];
+                  };
+                  "@home" = {
+                    mountpoint = "/home";
+                    mountOptions = ["compress=zstd" "noatime" "ssd"];
+                  };
+                  "@nix" = {
+                    mountpoint = "/nix";
+                    mountOptions = ["compress=zstd" "noatime" "ssd"];
+                  };
+                  "@persist" = {
+                    mountpoint = "/persist";
+                    mountOptions = ["compress=zstd" "noatime" "ssd"];
+                  };
+                  "@snapshots" = {
+                    mountpoint = "/.snapshots";
+                    mountOptions = ["compress=zstd" "noatime" "ssd"];
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}