feat: +thin-client role + AZ-TC-01..03 pilot

Auf Basis des Grilling-Sessions mit 20 design decisions umgesetztes
v1-Skeleton der Thin-Client-Rolle plus 3 Pilot-Hosts.

Architektur:
- roles/thin-client/ als geschlossene Rolle (default.nix compose + 7
  Subdirectories: hardware, session, identity, network, peripherals,
  apps, monitoring, deployment)
- hosts/AZ-TC-NN/default.nix als ~20-Zeilen-Wrapper pro Fleet-Host
- flake.nix instanziiert AZ-TC-01..03 via Fleet-Helper
- secrets.nix mit per-host agenix-Secret-Stubs

Submodule:
- hardware: dell-optiplex-micro + generic-x86_64-uefi Fallback
- identity: AD (sssd/krb5/keytab via agenix), lokale Notfalluser
  (sascha.koenig + jannik.mueller ohne m3ta-home), sudo-Policy
- session: KDE Plasma 6 + Wayland + SDDM, Branding (Wallpaper + Footer),
  PipeWire Audio
- network: NetworkManager + wpa_supplicant + 802.1X EAP-TLS, NetBird
  + SSH via NetBird, systemd-resolved (Corp + NetBird DNS), hardened
  firewall, OpenSSH
- peripherals: CUPS mit Pull-Print-Queue, pam_mount für DFS-Shares
- apps: Chromium (ManagedBookmarks, Bitwarden force-install, no local
  passwords), Office-Web .desktop-Shortcuts, Remmina (mehrere TS,
  Kerberos SSO), RustDesk Client + Daemon, OBS Studio, Autostart
- monitoring: node_exporter → Pushgateway, Alloy (stub für Loki),
  Snipe-IT Asset-Checkin (stub)
- deployment: Disko BTRFS-Layout, auto-upgrade daily + reboot window,
  snapper snapshots

Build-Validierung: 'nix flake check' bestanden für AZ-TC-01/02/03.

Siehe roles/thin-client/README.md für den Provisionierungs-Workflow
und die Liste der noch auszufüllenden Platzhalter (TODO-Kommentare
in den jeweiligen Modulen).

roles/thin-client/session/branding.nix

@@ -0,0 +1,85 @@
+# roles/thin-client/session/branding.nix
+#
+# Light branding: corporate wallpaper, SDDM logo overlay, Breeze Light,
+# Property-of-footer (hostname + IT hotline) on the lock screen.
+# Q17 decisions: Light Branding, no login banner, user may adjust KDE.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  inherit (lib) mkIf;
+  cfg = config.az.tc;
+in {
+  options.az.tc.branding = {
+    hotline = lib.mkOption {
+      type = lib.types.str;
+      default = "+49 30 1234567"; # TODO: real hotline
+      description = "IT-Hotline phone number for the property-of footer.";
+    };
+    wallpaper = lib.mkOption {
+      type = lib.types.path;
+      default = ./assets/wallpaper.svg;
+      description = ''
+        Path to a corporate wallpaper image (JPEG or SVG). Replace
+        `roles/thin-client/session/assets/wallpaper.svg` with the real
+        asset, or override this option.
+      '';
+    };
+    logo = lib.mkOption {
+      type = lib.types.path;
+      default = ./assets/logo.svg;
+      description = ''
+        Path to the corporate logo (SVG or PNG). Used in SDDM and lock
+        screen footer.
+      '';
+    };
+    company = lib.mkOption {
+      type = lib.types.str;
+      default = "AzIntec GmbH";
+      description = "Company name shown in the property-of footer.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment = {
+      etc = {
+        # Wallpaper — install to /etc/az-wallpaper so KDE's wallpaper plugin
+        # can find it via the standard search path.
+        "az-wallpaper".source = config.az.tc.branding.wallpaper;
+
+        # Default Plasma configuration as /etc/xdg — KDE reads these as
+        # the system-wide defaults. User-specific changes are layered on top.
+        "xdg/kdeglobals".text = ''
+          [General]
+          ColorScheme=Breeze Light
+
+          [KDE]
+          widgetStyle=Breeze
+
+          [Icons]
+          Theme=breeze
+
+          [Wallpaper]
+          Image=file:///etc/az-wallpaper
+        '';
+
+        # Lock-screen footer (rendered by kscreenlocker_greet).
+        "xdg/kscreenlockerrc".text = ''
+          [Greeter]
+          Logo=${config.az.tc.branding.logo}
+          Footer=${config.az.tc.branding.company} · ${config.networking.hostName} · IT-Hotline: ${config.az.tc.branding.hotline}
+        '';
+      };
+    };
+
+    # Property-of-footer via SDDM theme config. Lightweight: we don't
+    # ship a full custom SDDM theme — we just set the footer string that
+    # the default Breeze SDDM theme shows.
+    services.displayManager.sddm.settings.Theme = {
+      Wallpaper = config.az.tc.branding.wallpaper;
+      Logo = config.az.tc.branding.logo;
+    };
+  };
+}