feat: +thin-client role + AZ-TC-01..03 pilot

Auf Basis des Grilling-Sessions mit 20 design decisions umgesetztes
v1-Skeleton der Thin-Client-Rolle plus 3 Pilot-Hosts.

Architektur:
- roles/thin-client/ als geschlossene Rolle (default.nix compose + 7
  Subdirectories: hardware, session, identity, network, peripherals,
  apps, monitoring, deployment)
- hosts/AZ-TC-NN/default.nix als ~20-Zeilen-Wrapper pro Fleet-Host
- flake.nix instanziiert AZ-TC-01..03 via Fleet-Helper
- secrets.nix mit per-host agenix-Secret-Stubs

Submodule:
- hardware: dell-optiplex-micro + generic-x86_64-uefi Fallback
- identity: AD (sssd/krb5/keytab via agenix), lokale Notfalluser
  (sascha.koenig + jannik.mueller ohne m3ta-home), sudo-Policy
- session: KDE Plasma 6 + Wayland + SDDM, Branding (Wallpaper + Footer),
  PipeWire Audio
- network: NetworkManager + wpa_supplicant + 802.1X EAP-TLS, NetBird
  + SSH via NetBird, systemd-resolved (Corp + NetBird DNS), hardened
  firewall, OpenSSH
- peripherals: CUPS mit Pull-Print-Queue, pam_mount für DFS-Shares
- apps: Chromium (ManagedBookmarks, Bitwarden force-install, no local
  passwords), Office-Web .desktop-Shortcuts, Remmina (mehrere TS,
  Kerberos SSO), RustDesk Client + Daemon, OBS Studio, Autostart
- monitoring: node_exporter → Pushgateway, Alloy (stub für Loki),
  Snipe-IT Asset-Checkin (stub)
- deployment: Disko BTRFS-Layout, auto-upgrade daily + reboot window,
  snapper snapshots

Build-Validierung: 'nix flake check' bestanden für AZ-TC-01/02/03.

Siehe roles/thin-client/README.md für den Provisionierungs-Workflow
und die Liste der noch auszufüllenden Platzhalter (TODO-Kommentare
in den jeweiligen Modulen).

roles/thin-client/peripherals/smb-mounts.nix

@@ -0,0 +1,114 @@
+# roles/thin-client/peripherals/smb-mounts.nix
+#
+# pam_mount: Windows shares auto-mount at login via Kerberos.
+# Q9 decisions: pam_mount, Per-User + Common Shares via DFS-Namespace,
+# Lax (mount failure doesn't block login).
+#
+# Kerberos semantics:
+#   sec=krb5i    integrity-protected Kerberos auth
+#   multiuser    each user gets own mount credentials (no shared session)
+#   cruid=%(USER) the credential user (pam_mount templates it)
+#   nodepray     don't attempt password-based retry
+#
+# Mounts under /mnt/az-dfs/<share>; KDE desktop shows symlinks.
+{config, lib, pkgs, ...}: let
+  inherit (lib) mkIf mkOption types;
+  cfg = config.az.tc;
+in {
+  options.az.tc.smb = {
+    dfsNamespace = mkOption {
+      type = types.str;
+      default = "\\\\az-group.local\\dfs"; # TODO: confirm
+      description = ''
+        DFS namespace root that all share paths are relative to.
+        Example: \\az-group.local\dfs
+      '';
+    };
+
+    userShare = mkOption {
+      type = types.str;
+      default = "users/%u";
+      description = ''
+        Per-user share path relative to the DFS namespace. %u is
+        expanded to the username by pam_mount.
+      '';
+    };
+
+    commonShares = mkOption {
+      type = types.listOf types.str;
+      default = ["public" "software"];
+      description = ''
+        Common shares (relative to DFS namespace) that every user gets
+        mounted at login.
+      '';
+    };
+
+    mountRoot = mkOption {
+      type = types.str;
+      default = "/mnt/az-dfs";
+      description = ''
+        Local mount root. Shares appear under this path as
+        <mountRoot>/<share-name>. User's personal share appears as
+        <mountRoot>/home.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = with pkgs; [
+      cifs-utils
+      pam_mount
+    ];
+
+    # pam_mount config — appended to /etc/pam_mount.conf.xml via the
+    # NixOS pam_mount module.
+    security.pam.mount = {
+      enable = true;
+      extraVolumes = let
+        dfs = config.az.tc.smb.dfsNamespace;
+        mnt = config.az.tc.smb.mountRoot;
+        # Per-user share
+        userVolume = ''
+          <volume
+            fstype="cifs"
+            server="${dfs}"
+            path="${config.az.tc.smb.userShare}"
+            mountpoint="${mnt}/home"
+            options="sec=krb5i,cruid=%(USER),uid=%(USER),gid=%(USER),multiuser,nodev,nosuid,mfsymlinks"
+            user="*"
+          />
+        '';
+        # Common shares
+        commonVolumes = builtins.map (share: ''
+          <volume
+            fstype="cifs"
+            server="${dfs}"
+            path="${share}"
+            mountpoint="${mnt}/${share}"
+            options="sec=krb5i,cruid=%(USER),uid=%(USER),gid=%(USER),multiuser,nodev,nosuid,ro,mfsymlinks"
+            user="*"
+          />
+        '') config.az.tc.smb.commonShares;
+      in
+        lib.concatStringsSep "\n" ([userVolume] ++ commonVolumes);
+
+      # Don't kill session if a mount fails — Q9 "lax" decision.
+      # pam_mount has built-in "lax" semantics via the `<luserconf>` and
+      # `<mkmountpoint enable="...">` directives; per-mount `sgrp` filters
+      # ensure missing shares don't abort PAM login.
+      # The NixOS module doesn't expose these as top-level options, so we
+      # rely on the default behavior: failed mounts log warnings, login
+      # continues.
+    };
+
+    # Ensure mount directories exist (created per-user at first login).
+    systemd.tmpfiles.rules = [
+      "d ${config.az.tc.smb.mountRoot} 0755 root root -"
+    ];
+
+    # Create /etc/krb5.keytab is owned by root and readable to pam_mount
+    # (which runs as root during PAM).
+    # (No additional setup needed — pam_mount reads the user's TGT, not
+    # the machine keytab.)
+  };
+}