feat: +thin-client role + AZ-TC-01..03 pilot

Auf Basis des Grilling-Sessions mit 20 design decisions umgesetztes
v1-Skeleton der Thin-Client-Rolle plus 3 Pilot-Hosts.

Architektur:
- roles/thin-client/ als geschlossene Rolle (default.nix compose + 7
  Subdirectories: hardware, session, identity, network, peripherals,
  apps, monitoring, deployment)
- hosts/AZ-TC-NN/default.nix als ~20-Zeilen-Wrapper pro Fleet-Host
- flake.nix instanziiert AZ-TC-01..03 via Fleet-Helper
- secrets.nix mit per-host agenix-Secret-Stubs

Submodule:
- hardware: dell-optiplex-micro + generic-x86_64-uefi Fallback
- identity: AD (sssd/krb5/keytab via agenix), lokale Notfalluser
  (sascha.koenig + jannik.mueller ohne m3ta-home), sudo-Policy
- session: KDE Plasma 6 + Wayland + SDDM, Branding (Wallpaper + Footer),
  PipeWire Audio
- network: NetworkManager + wpa_supplicant + 802.1X EAP-TLS, NetBird
  + SSH via NetBird, systemd-resolved (Corp + NetBird DNS), hardened
  firewall, OpenSSH
- peripherals: CUPS mit Pull-Print-Queue, pam_mount für DFS-Shares
- apps: Chromium (ManagedBookmarks, Bitwarden force-install, no local
  passwords), Office-Web .desktop-Shortcuts, Remmina (mehrere TS,
  Kerberos SSO), RustDesk Client + Daemon, OBS Studio, Autostart
- monitoring: node_exporter → Pushgateway, Alloy (stub für Loki),
  Snipe-IT Asset-Checkin (stub)
- deployment: Disko BTRFS-Layout, auto-upgrade daily + reboot window,
  snapper snapshots

Build-Validierung: 'nix flake check' bestanden für AZ-TC-01/02/03.

Siehe roles/thin-client/README.md für den Provisionierungs-Workflow
und die Liste der noch auszufüllenden Platzhalter (TODO-Kommentare
in den jeweiligen Modulen).

roles/thin-client/network/netbird.nix

@@ -0,0 +1,70 @@
+# roles/thin-client/network/netbird.nix
+#
+# NetBird client for Thin Clients. Per-host setup-key via agenix.
+# Q15 decisions: Per-Host Setup-Key, Corp DNS + NetBird DNS parallel,
+# Client-only + accept-routes.
+#
+# SSH via NetBird: enabled (Q7).
+{config, lib, pkgs, ...}: let
+  inherit (lib) mkIf mkOption types;
+  cfg = config.az.tc;
+  hostname = config.networking.hostName;
+in {
+  options.az.tc.netbird = {
+    setupKeyFile = mkOption {
+      type = types.path;
+      default = ../../secrets/${hostname}-netbird-setupkey.age;
+      readOnly = true;
+      description = ''
+        agenix-encrypted NetBird setup key for this host. Provisioned in
+        the NetBird UI before first boot. Decrypted to
+        /run/agenix/netbird-setupkey (referenced by the systemd service).
+      '';
+    };
+
+    managementUrl = mkOption {
+      type = types.str;
+      default = "https://netbird.az-group.local:443"; # TODO: real URL
+      description = "NetBird management URL (self-hosted).";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.netbird.enable = true;
+
+    systemd.services.netbird = {
+      environment = {
+        NB_DISABLE_SSH_CONFIG = "false"; # we want SSH-via-NetBird
+        NB_MGMT_URL = config.az.tc.netbird.managementUrl;
+        NB_SETUP_KEY = "file:/run/agenix/${hostname}-netbird-setupkey";
+      };
+      path = with pkgs; [shadow util-linux];
+
+      after = ["age-identity.service" "network-online.target"];
+      wants = ["age-identity.service" "network-online.target"];
+    };
+
+    # Per-host setup key (agenix)
+    age.secrets."${hostname}-netbird-setupkey" = {
+      file = config.az.tc.netbird.setupKeyFile;
+      mode = "0400";
+      owner = "root";
+      group = "root";
+    };
+
+    # SSH config: allow SSH via NetBird hosts (the netbird binary acts as
+    # a ProxyCommand when the target is a NetBird peer).
+    programs.ssh.extraConfig = ''
+      Match exec "${pkgs.netbird}/bin/netbird ssh detect %h %p"
+          PreferredAuthentications publickey
+          PubkeyAuthentication yes
+          PasswordAuthentication no
+          ProxyCommand ${pkgs.netbird}/bin/netbird ssh proxy %h %p
+          StrictHostKeyChecking accept-new
+          LogLevel ERROR
+    '';
+
+    # Loose reverse-path filter — required for overlay networks.
+    networking.firewall.checkReversePath = "loose";
+  };
+}